Patent ID: 9647985
Date: 2017-05-09
CPC Classifications: H04L

Claim:
1. A method of filtering packets at a network component, in response to a presumed attack, comprising the steps of: providing at least one rule, each said rule including a match component and an action component, wherein said action component is selected from a group consisting of a bypass action component, a drop action component or a notify action component; and, for each packet and for each said rule: if said each packet maps to said match component of said each rule: handling said each packet according to said action component of said each rule; wherein, if said each rule also includes a limit component, the method also includes the step of: if said each packet maps to said match component of said each rule: updating a family history of said each rule, for each time said each packet maps to said match component of said rule; and, said each packet is handled according to said action component of said each rule only if said family history of said each rule satisfies said limit component of said each rule, wherein if said action component is said notify action component, update a global history for each packet received; and, said limit component is selected from the group consisting of: an absolute packet rate; an absolute byte rate; an absolute rate of opening new connections; a relative packet rate; a relative byte rate; a relative rate of opening new connections; and, a relative number of concurrently open connections.