Patent ID: 8843645

Claim:
A method for preventing Denial of Service (DoS) attacks, the method comprising: (a) receiving, by a device intermediary to a client and a server, via a transport layer connection between the device and the client, a first packet of an application layer transaction between the client and the server, the first packet comprising a protocol data structure of an application layer protocol; (b) recording, by the device, a last activity time for the transport layer connection based on a timestamp of receipt of the first packet by the device; (c) determining, by the device, that a second data packet of the transport layer connection received by the device does not complete the protocol data structure of the application layer protocol of the first packet; (d) retaining, by the device, the last activity time for the transport layer connection based on the timestamp of receipt of the first packet by the device responsive to determining that the second data packet of the transport layer connection does not complete the protocol data structure; and (e) determining, by the device, that a duration of inactivity for the transport layer connection exceeds a predetermined threshold.