Patent ID: 8707419
Filing Date: 2014-04-22
Classification: H04L

Abstract:
1. A method for protecting against high volume attacks using an apparatus comprising a processor communicably coupled to a memory, the method comprising the steps of: receiving a packet at the apparatus; determining a source of the received packet using the processor; creating a pattern key that uniquely identifies the source of the received packet; updating a tree-based data structure within the memory based on the pattern key using the processor, wherein the tree-based data structure comprises a set of root, intermediate and leaf nodes linked together based on the pattern key such that two or more statistics are maintained for each node and the two or more statistics comprise an actual aggregation count of how many sources of the received packets are represented by the corresponding node and a packet count of how many of the received packets have traversed the corresponding node; accepting the received packet whenever none of the statistics stored within the tree-based data structure for each node between the root node and the node corresponding to the source of the received packet exceed a threshold using the processor, wherein the threshold comprises: dropping the received packet whenever one or more of the statistics stored within the tree-based data structure for any node between the root node and the node corresponding to the source of the received packet exceed the threshold using the processor.