Patent ID: 8020205

Claim:
A network attack detection system, comprising a hardware communications monitor programmed to perform the steps of: examining a header of a packet in transmission; observing values of one or more pre-specified fields in the packet header; and in a case where a number of distinct values observed in the pre-specified fields reaches a pre-specified threshold suggesting a pre-specified ratio within a pre-specified time interval, judging that an unauthorized attack is in progress; wherein the judging is carried out based on one of the following conditions where N(t) is the number of distinct values of the field observed within a pre-specified time interval from time t, N(t 1 ) is the number of distinct values of the field observed within the pre-specified time interval from some time t 1 , P(t) is a number of packets in transmission within the pre-specified time interval from time t, P(t 1 ) is the number of packets in transmission within the pre-specified time interval from some time t 1 , and T(t) is the number of octets or bits in the packets in transmission within the pre-specified time interval from some time t: (a) if the ratio of N(t) to N(t 1 ) is greater than or equal to a first pre-specified threshold k 1 , that is, if N(t)/N(t 1 )≧k 1 , the system will judge that an attack is in progress; (b) if the ratio of N(t) to P(t) is greater than or equal to a second pre-specified threshold k 2 , that is, N(t)/P(t)≧k 2 , the system will judge that an attack is in progress; (c) if the ratio of {N(t)/P(t)} to {N(t 1 )/P(t 1 )}, is greater than or equal to a third pre-specified threshold k3, that is, {N(t)/P(t)}/{N(t 1 )/P(t 1 )}≧k3, the system will judge that an attack is under progress; or (d) if the ratio N(t) to T(t) is greater than or equal to a fourth pre-specified threshold k 4 , that is, N(t)/T(t)≧k 4 , the system will judge that an attack is in progress.