Patent ID: 9749340
Date: 2017-08-29
CPC Classifications: H04L

Claim:
1. A computer-implemented method for monitoring traffic in a network, the method comprising: monitoring, by a network monitoring probe, data packets sent from an external device attempting to access one or more server devices in a protected network; detecting a Transport Control Protocol (TCP) window advertisement value for each monitored data packet; determining if a detected TCP window advertisement value for monitored packets sent from an external device is less than a TCP window advertisement threshold value wherein the TCP window advertisement threshold value for a packet data connection is determined by statistical analysis by monitoring the TCP window advertisement values during the packet data connection between an external device and a protected client; determining if a data rate for the monitored packets sent to the one or more server devices is less than a data rate threshold value if the detected TCP window advertisement value is less than the TCP window advertisement threshold value; determining the monitored packets sent from the external device to the one or more server devices in the protected network to be malicious if the detected window advertisement value is less than the TCP window advertisement threshold value and the determined data rate is less than the data rate threshold value.