Patent ID: 8091132

Claim:
A method, comprising: examining a first incoming packet to determine if it is associated with an individual TCP flow of an admitted TCP connection; responsive to determining that the first incoming packet is associated with an individual TCP flow of an admitted TCP connection, calculating a probability of testing the individual TCP flow of the admitted TCP connection with which the first incoming packet is determined to be associated; determining, based on the probability of testing the individual TCP flow, if the individual TCP flow is to be tested to determine if the individual TCP flow represents an attack flow or a benign flow; responsive to determining that the individual TCP flow is to be tested, testing the individual TCP flow to determine if the individual TCP flow represents an attack flow or a benign flow, said testing including: delaying transmission of an acknowledgment of the first incoming packet to a source of the individual TCP flow; and determining, based on at least one further incoming packet associated with the individual TCP flow, if the source of the individual TCP flow adjusts its transmission rate in response to the delaying; and admitting the first incoming packet if the source of the individual TCP flow adjusts its transmission rate in response to the delaying.