Patent ID: 8990938
Filing Date: 2015-03-24
Classification: H04L

Abstract:
1. A method performed by a computing device connected to a network and having one or more processors and memory storing one or more programs for execution by the one or more processors, comprising: configuring the computer device to receive mirrored versions of transmissions sent by a destination node in response to initiating transmissions sent by a source node and received by the destination node over the network; receiving at least one mirrored response transmission sent from the destination node in response to at least one corresponding initiating transmission sent by the source node including receiving a plurality of mirrored response transmissions sent from the destination node wherein the plurality of mirrored response transmissions sent from the destination node comprise one of a requested resource from the destination node and at least one failure message indicating that the at least one resource is not available from the destination node; analyzing the at least one mirrored response transmission sent by the destination node to determine whether or not the corresponding at least one initiating transmission sent by the source node is malicious including computing a rate of failure messages sent to that at least one source node in the plurality of mirrored response transmissions sent from the destination node and determining that the at least one source node is sending malicious traffic if the rate of failure messages exceeds a predetermined threshold wherein computing a rate of failure messages includes calculating a ratio comprising a number of failure messages to a total of corresponding initiating transmissions; and receiving a plurality of corresponding initiating transmissions from at least one source node prior to receiving the at least one mirrored response transmission wherein the plurality of corresponding initiating transmissions from the at least one source node are requests for at least one resource from the destination node; sending the plurality of corresponding initiating transmissions to the destination node; determining that the corresponding initiating transmission is malicious in response to the ratio meeting a predetermined threshold; identifying a source node of the corresponding initiating transmission; and preventing future transmissions from the source node reaching the destination node.