Patent ID: 7114182
Filing Date: 2006-09-26
Classification: H04L

Abstract:
1. A method of detecting an abnormal number of unsuccessful connection attempts in a router located between a LAN and a network in a communications system, the method comprising the steps: a) maintaining a count of SYN packets, a count of SYN/ACK packets, and a count of FIN packets, for packets arriving on the LAN side of the router during a predetermined time interval; b) maintaining a count of SYN packets, a count of SYN/ACK packets, and a count of FIN packets, for packets arriving on the network side of the router during the predetermined time interval; c) multiplying each count by a respective weighting factor, wherein: d) calculating a parameter that equals the sum of the products of step c), the parameter for detecting attacks; and e) determining that an abnormal number of unsuccessful connection attempts has occurred responsive to the behavior defined in step d) over successive time intervals.