Patent ID: 7114182

Claim:
A method of detecting an abnormal number of unsuccessful connection attempts in a router located between a LAN and a network in a communications system, the method comprising the steps: a) maintaining a count of SYN packets, a count of SYN/ACK packets, and a count of FIN packets, for packets arriving on the LAN side of the router during a predetermined time interval; b) maintaining a count of SYN packets, a count of SYN/ACK packets, and a count of FIN packets, for packets arriving on the network side of the router during the predetermined time interval; c) multiplying each count by a respective weighting factor, wherein: i) the weighting factor associated with each count in step a) is positive; ii) the sum of the weighting factors of any partial connection coming from the attacking side is positive; and iii) the sum of the weighting fuctors associated with the counts of SYN and FIN packets in one direction plus the sum of the weighting factors associated with the counts of SYN/ACK and FIN in the other direction is zero; d) calculating a parameter that equals the sum of the products of step c), the parameter for detecting attacks; and e) determining that an abnormal number of unsuccessful connection attempts has occurred responsive to the behavior defined in step d) over successive time intervals.