Patent ID: 7584507
Filing Date: 2009-09-01
Classification: H04L

Abstract:
1. A method for detecting a denial of service attack to a networked device comprising: using each of a plurality of traffic monitors, monitoring a corresponding plurality of network data instances flowing across a corresponding data connection to generate a corresponding plurality of inbound and outbound keys each extracted from a unidirectional portion of the corresponding plurality of network data instances; using each of a plurality of local analyzers corresponding to a local portion of the plurality of traffic monitors, deriving at least one 2D matching feature, wherein the 2D matching feature comprises one of a matched inbound/outbound key pair and an unmatched inbound/outbound key pair associated with the corresponding data connection; using at least one global analyzer, matching a first unmatched inbound/outbound key pair derived by a first local analyzer to a second unmatched inbound/outbound key pair derived by a second local analyzer to adjust the at least one 2D matching feature to generate an adjusted 2D matching feature when the at least one 2D matching feature comprises the unmatched inbound/outbound key pair; and detecting a denial of service attack based on one of the at least one 2D matching feature and the adjusted 2D matching feature.