Patent ID: 7836496
Filing Date: 2010-11-16
Classification: G06F,H04L

Abstract:
1. A method for protecting a network from an attack, the method comprising: measuring a time-related property of traffic entering the network, including observing packets arriving on connections of a stateful protocol; transforming the time-related property of the traffic into a frequency domain; analyzing the property in the frequency domain in order to detect the attack; and filtering the traffic entering the network in order to block traffic participating in the attack, wherein analyzing the property comprises constructing and analyzing a matrix in the frequency domain, dividing the matrix into regions characterized by respective packet arrival intensities expressed as respective numbers of the connections in each region, and computing a ratio of (a) a first sum of the packet arrival intensities over a first portion of the regions to (b) a second sum of the packet arrival intensities over a second portion of the regions.