Patent ID: 8272044
Filing Date: 2012-09-18
Classification: H04L

Abstract:
1. A method of providing low rate Denial of Service (DoS) attack detection and mitigation, the method comprising: receiving an incoming packet at a router; updating a flow size estimation table in response to receipt of the incoming packets; determining, using a processor, if a flow in the flow size estimation table is expired, wherein an expired flows has not received incoming packets for a period of time; in response to determining the expired flow, computing a flow traffic load; determining if the received incoming packet corresponds to a new flow; and if the received incoming packet corresponds to a new flow and the flow traffic load is above a predetermined threshold, computing length of a current queue and if the length is greater than a percent threshold of a queue limit, the received incoming packet is dropped, wherein a new flow is determined by checking a benign flow table for a flow entry corresponding to the received incoming packet.