Patent ID: 7464404
Filing Date: 2008-12-09
Classification: G06F,H04L

Abstract:
1. A method of responding to a truncated secure session attack, comprising the steps of: forming a direct table having a plurality of slots associated with leader values of internet protocol addresses, each slot having a leaf to keep a count of packets in a pre-specified time interval; receiving an inbound packet having a header value that distinguishes it as the earliest essential step above transmission control protocol, and an internet protocol address; incrementing the count in the slot associated with the internet protocol address; determining at the end of the pre-specified time interval whether a subset of the slots have a high count or high count increase over previous time intervals; applying a blocking measure for internet protocol addresses associated with the subset of slots for a duration that is determined adaptively; suspending the blocking measure at the end of the duration; and wherein the duration is determined adaptively in response to a count of a number of times that the blocking measure has been applied, an interval of time and a count of traffic.