Patent ID: 8392991
Filing Date: 2013-03-05
Classification: H04L

Abstract:
1. A method of detecting and mitigating low rate Denial of Service (DoS) attacks, the method comprising: receiving incoming packets at a router in a network; determining if a total number of bytes of expired flows in communication flows received at the router exceed a threshold; and if so, an attack is detected and a proactive test-based differentiation technique (PTDT) module is activated, wherein the PTDT module is configured to perform operations comprising: receiving a communication packet; if the received communication packet indicates a new flow, communicating a puzzle, wherein the puzzle is configured to ascertain whether the communication packet originated by human control; if the received communication packet indicates a non-new flow, testing the non-new flow by dropping a single data packet from the non-new flow and monitoring changes in communication rate of the non-new flow, wherein a legitimate flow reduces the communication rate and a non-legitimate flow does not reduce the communication rate; incrementing a pass counter depending on the monitored changes in the communication rate; and admitting communication flows into the network based on the pass counter.