Patent ID: 12261879

DETAILED DESCRIPTION

As described above, previous technologies fail to provide efficient and reliable solutions to detect DoS attacks on one or more user profiles. This disclosure provides various systems and methods to detect DoS attacks on one or more user profiles. In one embodiment, system100to detect DoS attacks on one or more user profiles is described inFIG.1. In one embodiment, Table200illustrating an example scenario of system100to detect DoS attacks on one or more user profiles is described inFIG.2. In one embodiment, method300for detecting DoS attacks on one or more user profiles is described inFIG.3.

Example System for Denial-of-Service (DoS) Attack Detection

FIG.1illustrates one embodiment of a system100that is configured to detect DoS attacks114on one or more user profiles122. In one embodiment, system100comprises a server140. In some embodiments, system100further comprises a network110and one or more computing devices120, such as computing devices120aand120b. Network110enables communications between components of the system100. Server140comprises a processor142in signal communication with a memory148. Memory148stores software instructions150that when executed by the processor142, cause the processor142to perform one or more functions described herein. For example, when the software instructions150are executed, the processor142executes a DoS detection engine144to detect DoS attacks114on one or more user profiles122. In other embodiments, system100may not have all of the components listed and/or may have other elements instead of, or in addition to, those listed above.

System Components

Network110may be any suitable type of wireless and/or wired network, including, but not limited to, all or a portion of the Internet, an Intranet, a private network, a public network, a peer-to-peer network, the public switched telephone network, a cellular network, a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), and a satellite network. The network110may be configured to support any suitable type of communication protocol as would be appreciated by one of ordinary skill in the art.

Each of the computing devices120aand120bis an instance of a computing device120. Computing device120is generally any device that is configured to process data and interact with users102. Examples of the computing device120include, but are not limited to, a personal computer, a desktop computer, a workstation, a server, a laptop, a tablet computer, a mobile phone (such as a smartphone), etc. The computing device120may include a user interface, such as a display, a microphone, keypad, or other appropriate terminal equipment usable by user102. The computing device120may include a hardware processor, memory, and/or circuitry configured to perform any of the functions or actions of the computing device120described herein. For example, a software application designed using software code may be stored in the memory and executed by the processor to perform the functions of the computing device120. The system100may include any number of computing devices120. For example, system100may include multiple computing devices120that are associated with an organization, where the server140is also associated with the same organization and is configured to oversee incoming and outgoing communications of the computing devices120.

A user102can log in to their user profile122using a computing device120. In the example ofFIG.1, the user102amay attempt to log in to their user profile122ausing the computing device120a. To this end, the user102ainputs their login credentials104ainto a portal, a webpage, or an interface displayed on a screen of the computing device120a. upon receiving the login credentials104a, the computing device120asends a request to the server140to verify the login credentials104a. This event is captured as a login attempt106aby the server140(via the processor142). Likewise, the user102bmay attempt to log in to their user profile122busing the computing device120b. This event is captured as a login attempt106bby the server140(via the processor142).

To verify a login credential104, the processor142compares the provides login credentials104(e.g., password) with information previously set by the user102and stored in a database, such as a login credential112associated with the user102that is stored in the memory148. If the processor142detects that the provided login credential104does not match the login credential112, the processor142determines that this is an invalid sign-on attempt108. In some cases, a bad actor (whether external or internal with respect to the organization) may attempt to access one or more user profiles122by attempting multiple passwords to access each of the one or more user profiles122. For example, a bad actor may launch a cyberattack, brute force attack, etc. to gain unauthorized access to one or more user profiles122. In some cases, a user102may intentionally or inadvertently attempt to access one or more user profiles122by attempting multiple passwords to access each of the one or more user profiles122. In some cases, a bad actor and/or a user102may launch a DoS attack by attempting multiple passwords on one or more user profiles122in an attempt to shut down or slow down one or more computing devices120, network110, and server140, occupy network bandwidth, etc. Current technology does not provide a solution to detect such DoS attacks114. System100provides a technical solution and practical application of detecting DoS attacks114on one or more user profiles122.

Server

Server140is generally a device that is configured to process data and communicate with computing devices (e.g., computing devices120), databases, etc., via the network110. The server140is generally configured to oversee the operations of the DoS detection engine144, as described further below in conjunction with the operational flow of system100and method300described inFIG.3.

Processor142comprises one or more processors operably coupled to the memory148. The processor142is any electronic circuitry, including, but not limited to, state machines, one or more central processing unit (CPU) chips, logic units, cores (e.g., a multi-core processor), field-programmable gate array (FPGAs), application-specific integrated circuits (ASICs), or digital signal processors (DSPs). The processor142may be a programmable logic device, a microcontroller, a microprocessor, or any suitable combination of the preceding. The one or more processors are configured to process data and may be implemented in hardware or software. For example, the processor142may be 8-bit, 16-bit, 32-bit, 64-bit, or of any other suitable architecture. The processor142may include an arithmetic logic unit (ALU) for performing arithmetic and logic operations, processor142registers the supply operands to the ALU and store the results of ALU operations, and a control unit that fetches instructions from memory and executes them by directing the coordinated operations of the ALU, registers and other components. The one or more processors are configured to implement various instructions. For example, the one or more processors are configured to execute instructions (e.g., software instructions150) to implement the DoS detection engine144. In this way, processor142may be a special-purpose computer designed to implement the functions disclosed herein. In an embodiment, the processor142is implemented using logic units, FPGAs, ASICs, DSPs, or any other suitable hardware. The processor142is configured to operate as described inFIGS.1-3. For example, the processor142may be configured to perform one or more steps of method300as described inFIG.3.

Network interface146is configured to enable wired and/or wireless communications (e.g., via network110). The network interface146is configured to communicate data between the server140and other devices (e.g., computing devices120), databases, systems, or domains. For example, the network interface146may comprise a WIFI interface, a local area network (LAN) interface, a wide area network (WAN) interface, a modem, a switch, or a router. The processor142is configured to send and receive data using the network interface146. The network interface146may be configured to use any suitable type of communication protocol as would be appreciated by one of ordinary skill in the art.

Memory148may be volatile or non-volatile and may comprise a read-only memory (ROM), random-access memory (RAM), ternary content-addressable memory (TCAM), dynamic random-access memory (DRAM), and static random-access memory (SRAM). Memory148may be implemented using one or more disks, tape drives, solid-state drives, and/or the like. Memory148is operable to store the invalid sign-on attempts108, login credentials112, software instructions150, first time interval152, number of invalid sign-on attempts154, scan-level threshold number156, threshold number158, single-user profile threshold number160, second time interval162, alerts164, number of disabled user profiles168, DoS attacks114, and/or any other data or instructions. The software instructions150may comprise any suitable set of instructions, logic, rules, or code operable to execute the processor142.

DoS Detection Engine

DoS detection engine144may be implemented by the processor142executing the software instructions150, and is generally configured to detect DoS attacks114on one or more user profiles122.

In one embodiment, the DoS detection engine144may be triggered to scan login attempts106at every time interval152. The time interval152may be fifteen minutes, thirty minutes, one hour, or any other suitable time interval.

The DoS detection engine144is configured to detect whether each login attempt106failed or succeeded. For example, with respect to login attempt106ainitiated by the user102a, the DoS detection engine144determines whether the login attempt106afailed or succeeded by comparing the password associated with the login credentials104awith the password associated with the login credentials112. If the DoS detection engine144determines that the password associated with the login credentials104amatches the password associated with the login credentials112, the DoS detection engine144determines that the login attempt106asucceeded. Otherwise, the DoS detection engine144determines that login attempt106ais an invalid sign-on attempt108. The DoS detection engine144may perform a similar operation for every login attempt106during the time interval152.

The DoS detection engine144is configured to accept a scan-level threshold number156, a threshold number158, and a single-user profile threshold number160. The DoS detection engine144uses this information to detect whether the total number of invalid sign-on attempts154detected during different time intervals exceeds a particular threshold number. This process is described in detail below.

Operational Flow

Operational flow of the system100begins where the DoS detection engine144collects invalid sign-on attempts154detected during a predefined scan interval or time interval152. The collected invalid sign-on attempts154may be associated with multiple users102. In this process, the DoS detection engine144detects whether each sign-on attempt106detected during the time interval152failed or succeeded, similar to that described above. If a login attempt106fails, the DoS detection engine144increments the total number of invalid sign-on attempts154by one.

Referring toFIG.2, an example scenario where the DoS detection engine144detects DoS attacks114on one or more user profiles122is shown. In Table200, the DoS attack parameters210are shown. In the example ofFIG.2, assume that the total number of user profiles122is 274, the single-user profile threshold number160is 50, scan-level threshold number156is 41 (which is 15% of 274, the total number of user profiles122), and the second threshold number158is 82 (which is 30% of 274, the total number of user profiles122). Also, assume that the DoS detection engine144has detected 633 invalid sign-on attempts154in the last scan or the last time interval152, e.g., since yesterday. Also, assume that the DoS detection engine144has detected 674 invalid sign-on attempts154in the current scan or the first time interval152a. For example, an operator may set the scan-level threshold number156, threshold number158, and single-user profile threshold number160.

Referring back toFIG.1, the scan-level threshold number156may be associated with the time interval152. The scan-level threshold number156may be determined based on a particular percentage of the total number of user profiles122. For example, the scan-level threshold number156may be determined to be 15% of the total number of user profiles122. In other examples, the scan-level threshold number156may be any suitable percentage of the total number of user profiles122.

The scan-level threshold number156may be referred to as a first threshold number156. The single-user profile threshold number160may be associated with the time interval162(e.g., a day). For example, the single-user profile threshold number160may be fifty per day as shown in Table200. In other examples, the single-user profile threshold number160may be any suitable number associated with the time interval162.

The threshold number158may be determined based on a particular percentage of the total number of user profiles122, e.g., 30%, 35%, etc. of the total number of user profiles122. The second threshold number158may be associated with the second time interval162(e.g., a day).

Detecting a DoS Attack on a Single User Profile Based on Detecting Invalid Sign-On Attempts

The DoS detection engine144determines the number of invalid sign-on attempts154on each user profile122. For each user profile122, the DoS detection engine144determines whether the number of invalid sign-on attempts154exceeds the single-user profile threshold number160. The DoS detection engine144compares the maximum number of invalid sign-on attempts154detected on a single user profile122with the single-user profile threshold number160. The DoS detection engine144determines whether the maximum number of invalid sign-on attempts154on a single user profile122detected since the start of the first time interval152aexceeds the single-user profile threshold number160. If the DoS detection engine144determines that the maximum number of invalid sign-on attempts154on a single user profile122detected since the start of the first time interval152aexceeds the single-user profile threshold number160, the DoS detection engine144triggers an alert164a. The alert164amay indicate that a DoS attack114on a single user profile122is detected.

Referring toFIG.2, the first time interval152amay be from an initial timestamp to a first timestamp, e.g., from 8 am to 8:15 am, and the second time interval152bmay be from the first timestamp to a second timestamp, e.g., 8:15 am to 8:30 am.

With respect to the first time interval152a, assume that the DoS detection engine144has detected four invalid sign-on attempts106on the user profile122a, thirty invalid sign-on attempts154on the user profile122b, and one invalid sign-on attempt106on the rest of the user profiles122. In this example, the DoS detection engine144determines that the maximum number of invalid sign-on attempts106on a single user profile122is thirty, as shown in row 7 of Table200. In the example ofFIG.2, with respect to the first time interval152a, the DoS detection engine144determines that the maximum number of invalid sign-on attempts154on a single user profile122since the start of the first time interval152a(e.g., 30) does not exceed the single-user profile threshold number160(e.g., 50). Thus, in this particular example, the DoS detection engine144does not trigger the alert164a, as noted by “False” in row 10 with respect to the first time interval152a.

With respect to the second time interval152b, assume that the DoS detection engine144has detected that the maximum number of invalid sign-on attempts154on a single user profile122since the start of the first time interval152ais sixty. Thus, the DoS detection engine144determines that the maximum number of invalid sign-on attempts154on a single user profile122since the start of the first time interval152a(i.e., 60) exceeds the single-user profile threshold number160(i.e., 50). Thus, in this particular example, the DoS detection engine144triggers the alert164, as noted by “True” in row 10 with respect to the second time interval152b.

Detecting DoS Attacks on Multiple User Profiles Based on Detecting Invalid Sign-On Attempts

Referring back toFIG.1, the DoS detection engine144determines the difference between the total number of invalid sign-on attempts154on the user profiles122during the current time interval152and the previous time interval152(or previous scan). In other words, the DoS detection engine144determines how many invalid sign-on attempts154are added to (or removed from) the total number of invalid sign-on attempts154during each time interval152since the last time interval152. For each time interval152, the DoS detection engine144compares the change in the total number of invalid sign-on attempts154in that time interval152(with respect to its previous time interval152) with the scan-level threshold number156. If the DoS detection engine144determines that the increase in the total number of invalid sign-on attempts154in the current time interval152exceeds the scan-level threshold number156, the DoS detection engine144triggers an alert164b. The alert164bmay indicate that the increase in the total number of invalid sign-on attempts154in the current time interval152exceeds the scan-level threshold number156. The alert164bmay also indicate that a DoS attack114on multiple user profiles122is detected. The DoS detection engine144may send a message that contains the alert164bto email addresses associated with users102associated with user profiles122on which the invalid sign-on attempts154are detected.

Referring toFIG.2, with respect to the first time interval152a, the DoS detection engine144determines that the change in the total number of invalid sign-on attempts154since the previous scan or time interval152is 41 (i.e., 674-633), as shown in row 8 of Table200. In this particular example, the DoS detection engine144determines that the change in the total number of invalid sign-on attempts154in the time interval152asince the previous time interval152(i.e., 41) does not exceed the scan-level threshold number156(i.e., 41). Thus, in this particular example, the DoS detection engine144does not trigger the alert164b, as noted by “False” in row 11 with respect to the first time interval152a.

With respect to the second time interval152a, the DoS detection engine144determines that the change in the total number of invalid sign-on attempts154in the time interval152bsince the previous time interval152a(i.e., 115) exceeds the scan-level threshold number156(i.e., 41). Thus, the DoS detection engine144triggers the alert164b, as noted by “True” in row 11 with respect to the second time interval152b.

Detecting DoS Attacks on Multiple User Profiles During a Time Interval Based on Detecting Invalid Sign-On Attempts

Referring back toFIG.1, the DoS detection engine144determines the increase (and/or change) in the total number of invalid sign-on attempts154on the user profiles122since the start of the first time interval152a. For example, the DoS detection engine144may combine the number of invalid sign-on attempts154on the user profiles122in two or more time intervals152. The DoS detection engine144compares the combined number of invalid sign-on attempts154since the start of the first time interval152awith the second threshold number158. The DoS detection engine144determines whether the combined number of invalid sign-on attempts154since the start of the first time interval152ain two or more consecutive (or non-consecutive) time intervals152exceeds the second threshold number158. If the DoS detection engine144determines that the combined number of invalid sign-on attempts154since the start of the first time interval152ain two or more consecutive (or non-consecutive) time intervals152exceeds the second threshold number158, the DoS detection engine144triggers an alert164c. The alert164cmay indicate that a DoS attack114on multiple user profiles122during the combined intervals152is detected.

Referring toFIG.2, with respect to the first time interval152a, the DoS detection engine144determines that the combined number of invalid sign-on attempts154since the start of the first time interval152ais 42. The DoS detection engine144determines that the combined total number of invalid sign-on attempts154since the start of the first time interval152a(i.e., 41) does not exceed the second threshold number158(i.e., 82). Thus, in this particular example, with respect to the first time interval152a, the DoS detection engine144does not trigger the alert164c, as noted by “False” in row 12 with respect to the first time interval152a.

With respect to the second time interval152b, the DoS detection engine144determines that the combined total number of invalid sign-on attempts154during the first and second time intervals152aand152b(i.e., 157) exceeds the second threshold number158. Thus, the DoS detection engine144triggers the alert164c, as noted by “True” in row 12 with respect to the second time interval152b.

Referring back toFIG.1, in some embodiments, the DoS detection engine144is further configured to detect disabled user profiles122as a result of a DoS attack114. This process is described below. The DoS detection engine144may disable a user profile122if more than a threshold number of failed login attempts106within a threshold time duration (e.g., more than 10 failed login attempts106in 5 minutes) is detected on the user profile122.

Detecting DoS Attacks on Multiple User Profiles Based on Detecting Disabled User Profiles

The DoS detection engine144collects the number of disabled user profiles168during each time interval152. The DoS detection engine144determines the difference between the total number of disabled user profiles168detected in the current time interval152and the previous time interval152. If the DoS detection engine144determines that the difference between the total number of disabled user profiles168detected in the current time interval152and the previous time interval152exceeds the scan-level threshold number156, the DoS detection engine144triggers the alert164b.

In some embodiments, the scan-level threshold number156for detecting invalid sign-on attempts154and disabled user profiles168may be different from each other. For example, the scan-level threshold number156for detecting invalid sign-on attempts154may be 15% of the total number of user profiles122, and the scan-level threshold number156for detecting disabled user profiles122may be 5%, or any other suitable percentage of the total number of user profiles122.

Detecting DoS Attacks on Multiple User Profiles During a Time Interval Based on Detecting Disabled User Profiles

The DoS detection engine144determines the increase (and/or change) in the total number of disabled user profiles168since the start of the first time interval152a. For example, the DoS detection engine144may combine the number of disabled user profiles122in two or more consecutive (or non-consecutive) time intervals152. The DoS detection engine144compares the combined number of disabled user profiles168since the start of the first time interval152with the second threshold number158. The DoS detection engine144determines whether the combined number of disabled user profiles122since the start of the first time interval152ain two or more consecutive (or non-consecutive) time intervals152exceeds the second threshold number158. If the DoS detection engine144determines that the combined number of disabled user profiles168since the start of the first time interval152ain two or more consecutive (or non-consecutive) time intervals152exceeds the second threshold number158, the DoS detection engine144triggers the alert164c.

In some embodiments, the second threshold number158for detecting invalid sign-on attempts154and disabled user profiles168may be different from each other. For example, the second threshold number158for detecting invalid sign-on attempts154may be 30% of the total number of user profiles122, and the second threshold number158for detecting disabled user profiles122may be 10% or any other suitable percentage of the total number of user profiles122.

In some embodiments, the DoS detection engine144may be configured to exclude outliers from the total number of invalid sign-on attempts154and/or disabled user profiles168. For example, the DoS detection engine144may be configured to detect that an invalid sign-on attempt108is associated with a user102(e.g., a developer) who is in the process of testing a login web application interface and needs to test failed login cases. Thus, the DoS detection engine144may remove the detected invalid sign-on attempt108from the total number of invalid sign-on attempts154.

In another example, the DoS detection engine144may be configured to detect that an invalid sign-on attempt108has been validated, e.g., by answering security questions, verifying a passcode sent to a phone number of the user102, etc. Thus, the DoS detection engine144may exclude the invalid sign-on attempt108from the total number of invalid sign-on attempts154.

In another example, the DoS detection engine144may be configured to detect that a disabled user profile122has been validated, e.g., by answering security questions, verifying a passcode sent to a phone number of the102, etc. Thus, the DoS detection engine144may exclude the disabled user profile122from the total number of disabled user profiles168.

In some embodiments, the DoS detection engine144may account for new user profiles122that are created during a time interval152, and add them to the total number of user profiles122accordingly.

In some embodiments, the DoS detection engine144may account for user profiles122that are deleted during one or more time intervals152, and remove them from the total number of user profiles122accordingly.

In some embodiments, the DoS detection engine144may trigger any of the alerts164a-cby displaying a message that comprises a text describing the alert164on a screen on the server140and/or computing devices120, sending one or more messages that indicates the alert164to one or more authorized personnel, e.g., developers, information security personnel, etc. via an email message, text message, etc.

In some embodiments, the DoS detection engine144may detect whether the identity of a user102associated with an invalid sign-on attempt108that is detected during a time interval152, e.g., time interval152a, is verified during the first time interval152a. If the DoS detection engine144determines that the identity of the user102associated with the invalid sign-on attempt108is verified, the DoS detection engine144deducts the first number of invalid sign-on attempts154(detected during the first time interval152a) by one. If the DoS detection engine144determines that the identity of the user102associated with the invalid sign-on attempt108is verified during a different time interval152, e.g., second time interval152b, the DoS detection engine144deducts the second number of invalid sign-on attempts154(detected during the second time interval152b) by one.

Example Table for Detecting DoS Attacks on the One or More User Profiles

FIG.2illustrates the Table200that includes an example scenario where the DoS detection engine144detects DoS attacks on one or more user profiles122. The Table200may include any number of time intervals152. During any of the time intervals152any of and any combination of the alerts164a-cmay be triggered based on the determined changes in the number of invalid sign-on attempts154. Similarly, during any of the time intervals152any of and any combination of the alerts164aand164bmay be triggered based on the determined changes in the number of disabled user profiles122.

Example Method for DoS Attack Detection

FIG.3illustrates an example flowchart of a method300for detecting DoS attack114on one or more user profiles122. Modifications, additions, or omissions may be made to method300. Method300may include more, fewer, or other steps. For example, steps may be performed in parallel or in any suitable order. While at times discussed as the system100, processor142, DoS detection engine144, or components of any of thereof performing steps, any suitable system or components of the system may perform one or more steps of the method300. For example, one or more steps of method300may be implemented, at least in part, in the form of software instructions150ofFIG.1, stored on non-transitory, tangible, machine-readable media (e.g., memory148ofFIG.1) that when run by one or more processors (e.g., processor142ofFIG.1) may cause the one or more processors to perform steps302-322.

Method300begins at step302where the DoS detection engine144detects a first number of invalid sign-on attempts154with respect to a plurality of user profiles122occurred since the start of the first time interval152a. For example, the DoS detection engine144may collect the number of invalid sign-on attempts154that occurred on the user profiles122since the start of the first time interval152a, similar to that described inFIGS.1and2.

At step304, the DoS detection engine144determines whether the first number of invalid sign-on attempts154exceeds the first threshold number158. If the DoS detection engine144determines that the first number of invalid sign-on attempts154exceeds the first threshold number158, method300proceeds to step306. Otherwise, method300proceeds to step308.

At step306, the DoS detection engine144triggers the alert164cthat indicates detection of a first DoS attack114on multiple user profiles122during a particular time interval152, e.g., the first time interval152a, similar to that described above inFIGS.1and2.

At step308, the DoS detection engine144selects a user profile122from among the plurality of user profiles122. The DoS detection engine144iteratively selects a user profile122until no user profile122is left for evaluation.

At step310, the DoS detection engine144detects a second number of invalid sign-on attempts154with respect to the selected user profile122occurred during a second time interval162, where the second time interval162is a combination of two or more of the first time intervals152. For example, the first time interval152may be fifteen minutes, and the second time interval162may be twenty-four hours. In this process, the DoS detection engine144detects the number of invalid sign-on attempts154on the selected user profile122in each time interval152, and combines them.

At step312, the DoS detection engine144determines whether the second number of invalid sign-on attempts154exceeds the single-user profile threshold number160. If the DoS detection engine144determines that the second number of invalid sign-on attempts154exceeds the single-user profile threshold number160, method300proceeds to step314. Otherwise, method300proceeds to step316.

At step314, the DoS detection engine144triggers an alert164athat indicates detection of a second DoS attack114on the selected user profile122, similar to that described inFIGS.1and2.

At step316, the DoS detection engine144determines whether to select another user profile122. The DoS detection engine144determines to select another user profile122if at least one user profile122is left for evaluation. If the DoS detection engine144determines to select another user profile122, method300returns to step308. Otherwise, method300proceeds to step318.

At step318, the DoS detection engine144detects an increase (and/or change) in the third number of invalid sign-on attempts154with respect to the plurality of user profiles122that occurred during the first time interval152asince the previous time interval152, similar to that described inFIGS.1and2.

At step320, the DoS detection engine144determines whether the increase (and/or change) in the third number of invalid sign-on attempts154with respect to the plurality of user profiles122during the first time interval152since the previous time interval152exceeds the scan-level threshold number156. If the DoS detection engine144determines that the increase (and/or change) in the third number of invalid sign-on attempts154with respect to the plurality of user profiles122during the first time interval152since the previous time interval152exceeds the scan-level threshold number156, method300proceeds to step322. Otherwise, method300terminates.

At step322, the DoS detection engine144triggers an alert164bthat indicates detection of a third DoS attack114on multiple user profiles122since the previous time interval152, e.g., during multiple time intervals152, similar to that described inFIGS.1and2.

The DoS detection engine144may perform one or more steps of method300in every time interval152and/or time interval162.

In some embodiments, method300may include one or more additional steps to detect the number of disabled user profiles122, and trigger one or more alerts164based on the detected number of disabled user profiles122, similar to that described inFIGS.1and2.

While several embodiments have been provided in the present disclosure, it should be understood that the disclosed systems and methods might be embodied in many other specific forms without departing from the spirit or scope of the present disclosure. The present examples are to be considered as illustrative and not restrictive, and the intention is not to be limited to the details given herein. For example, the various elements or components may be combined or integrated with another system or certain features may be omitted, or not implemented.

In addition, techniques, systems, subsystems, and methods described and illustrated in the various embodiments as discrete or separate may be combined or integrated with other systems, modules, techniques, or methods without departing from the scope of the present disclosure. Other items shown or discussed as coupled or directly coupled or communicating with each other may be indirectly coupled or communicating through some interface, device, or intermediate component whether electrically, mechanically, or otherwise. Other examples of changes, substitutions, and alterations are ascertainable by one skilled in the art and could be made without departing from the spirit and scope disclosed herein.

To aid the Patent Office, and any readers of any patent issued on this application in interpreting the claims appended hereto, applicants note that they do not intend any of the appended claims to invoke 35 U.S.C. § 112(f) as it exists on the date of filing hereof unless the words “means for” or “step for” are explicitly used in the particular claim.