Patent ID: 9055100
Filing Date: 2015-06-09
Classification: H04L

Abstract:
1. A method for changing an application layer transaction timeout to prevent Denial of Service (DOS) attacks, the method comprising: (a) receiving, by a device intermediary to a client and a server, via a transport layer connection between the device and the client, a packet of an application layer transaction, the transport layer connection having a maximum segment size; (b) incrementing, by the device, an attack counter for the transport layer connection by a first predetermined amount responsive to a size of the packet being less than a predetermined fraction of the maximum segment size for the transport layer connection, the device decrementing the attack counter by a predetermined decrement for each packet that has a size greater than the predetermined fraction of the maximum segment size; (c) incrementing, by the device, the attack counter for the transport layer connection by a second predetermined amount responsive to an inter-packet-delay between the packet and a previous packet being more than a predetermined multiplier of a round trip time; and (d) changing, by the device, a timeout for the application layer transaction responsive to comparing the attack counter to a predetermined threshold.