Patent ID: 7640338

Claim:
A computer-readable storage medium having thereon computer-executable instructions for implementing, when executed on a computer, a method of mitigating malicious network node activity, the method comprising: receiving a protocol message of a transmission control protocol (TCP) over a transmission control protocol TCP connection; determining that the protocol message is a questionable protocol message, wherein the questionable protocol message includes a sequence number that does not match a next expected sequence number and an acknowledgment number that is outside of a range between an oldest unacknowledged sequence number and a highest sequence number sent; and when it is determined that the protocol message is the questionable protocol message and a limit on an allowed number of challenge probes sent is not reached, wherein the limit is reached when a probe count variable equals or exceeds the limit: sending a challenge probe; incrementing the probe count variable; receiving a response to the challenge probe, the response comprising at least one data field, the at least one data field having at least one value; and determining that the protocol message is an illegitimate protocol message as a function of at least the at least one value of the at least one data field of the response.