Patent ID: 7933985
Filing Date: 2011-04-26
Classification: H04L

Abstract:
1. A method for detecting attacks in a communications network, the method comprising: calculating first traffic volume of messages destined for one or more devices at a first sampling time and a second traffic volume of messages destined for the one or more devices at a second sampling time, respectively; calculating an average acceleration (A avg ), based on an acceleration (A n ) for sampling times wherein A avg =(sum of each A n )/n, A n =(1−α)A n-1 ++(V n −V n-1 ), n is the second sampling time, n−1 is the first sampling time, A n-1 is a previous acceleration, V n is the second traffic volume of messages, V n-1 is the first traffic volume of messages, and α is a sensitivity factor (0≦α≧1) enabling adjustment of the calculation for A n ; detecting the attacks by identifying whether the average acceleration has crossed a threshold; and servicing the plurality of messages only if the average acceleration has not crossed the threshold.