Patent Document ID: 10038715
Application ID: 15793569
Patent Status: 1

Claim One:
1. A method in a server, comprising: receiving a first SYN packet; generating a first SYN packet signature of the first SYN packet, wherein the first SYN packet signature describes the first SYN packet, and wherein the first SYN packet signature includes a plurality of elements; generating a first plurality of aggregate signatures for the first SYN packet signature, wherein each of the plurality of aggregate signatures includes the plurality of elements, wherein each of the first plurality of aggregate signatures includes a generalized value for at least one of the plurality of elements, wherein each respective one of the first plurality of aggregate signatures has a different level of specificity that corresponds with one of a plurality of fingerprint tables, and wherein each fingerprint table includes a set of one or more fingerprints and a set of one or more counters respectively; for each of the first plurality of aggregate signatures starting with a most specific one of the first plurality of aggregate signatures and corresponding fingerprint table and moving to a next most specific one of the first plurality of aggregate signatures and corresponding fingerprint table until one of the set of counters exceeds a threshold, performing the following: comparing that aggregate signature with the set of one or more fingerprints of that fingerprint table to determine whether that aggregate signature matches one of the set of fingerprints in that fingerprint table; responsive to determining that the aggregate signature matches one of the set of one or more fingerprints of that fingerprint table, incrementing the counter that corresponds with that matching fingerprint, responsive to determining that the counter exceeds the threshold, stopping the counting and outputting that aggregate signature as an attack fingerprint; generating, using the attack fingerprint as input, a bytecode of the attack fingerprint in a form understandable by a network filter; and causing the generated bytecode to be installed into the network filter so that subsequent SYN packets that are received and match the generated bytecode are subject to the network filter.