Patent ID: 8667585

Claim:
A computer-implemented Transmission Control Protocol (TCP) flooding attack prevention method, comprising: identifying a type of a packet received at an intermediate stage between a client and a server; determining a direction of the packet; defining a session state that represents a state of a session between the client and the server based on the type and the direction of the packet; detecting a TCP flooding attack by tracking session states for a flow including a set of packets received between the client and the server; and responding to the TCP flooding attack, wherein one or more of the above steps are performed using a computer processor, and wherein: the detecting comprises detecting an open flooding attack when a number of session states, in which the server receives a first acknowledgement (ACK) packet and a session connection is established, is equal to or larger than a third threshold; and the responding comprises managing a source IP of a packet for which the open flooding attack has been detected using a list, and blocking traffic transmitted from the corresponding source IP for a predetermined time.