Patent ID: 9712490
Date: 2017-07-18
CPC Classifications: H04L

Claim:
1. A method comprising: reassembling transmission control protocol (TCP) data of a plurality of packets of a first packet flow within a network from a client to a server to produce reassembled data for the first packet flow; performing an initial identification of a type of software application executed by a client to determine a first type of software application for the software application executed by the client, wherein the software application generates the first packet flow, and wherein performing the initial identification comprises: selecting a first set of attack patterns associated with the first type of software application, wherein the first set of attack patterns defines characteristics of packet flows generated by the first type of software application when the first type of software application is performing a network attack; prior to receiving a second packet flow from the server to the client in response to the first packet flow from the client to the server, wherein the first packet flow and the second packet flow form a communication session between the client and the server, applying the first set of attack patterns to the first packet flow to determine whether the first packet flow from the client to the server represents a network attack; after receiving the second packet flow from the server to the client, reassembling TCP data of a plurality of packets of the second packet flow to produce reassembled data for the second packet flow; using the reassembled data for the second packet flow to determine an updated identification of the type of software application executed by the client to determine a second type of software application for the software application executed by the client, wherein the second type of application is different than the first type of application, and wherein using the reassembled data for the second packet flow to determine the updated identification comprises: selecting a second set of attack patterns associated with the second type of application, wherein the second set of attack patterns is different than the first set of attack patterns, and wherein the second set of attack patterns defines characteristics of packet flows generated by the second type of software application when the second type of software application is performing a network attack; and applying the second set of attack patterns to the first packet flow from the client to the server to determine whether the first packet flow from the client to the server represents a network attack.