Attack Mitigation in Packet Switched Networks

Abstract

The disclosed computer-implemented method includes applying a transport protocol heuristic algorithm to a selective acknowledgment (SACK) message received by a network adapter from a network node. The transport protocol heuristic algorithm identifies a threshold of an operational function to be performed when processing the SACK message. The method also includes determining that a threshold of the transport protocol heuristic algorithm has been reached by applying the transport protocol heuristic algorithm to the SACK message received from the network node. In response to determining that the threshold has been reached, the method includes identifying the network node as a security threat and taking remedial action to mitigate the security threat. Various other methods, systems, and computer-readable media are also disclosed.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims the benefit of U.S. Provisional Application No. 62 / 870,621, filed on July 3, 2019, and U.S. Non-Provisional Application No. 16 / 576,556, filed on September 19, 2019, the disclosures of which are incorporated herein by reference in their entireties. Background Art

[0003] Every day, large amounts of data are transmitted around the world over computer networks. These networks break data files into smaller data packets that are transmitted over wired and wireless data links. Data packets are transmitted using various protocols. These protocols are often referred to as transport protocols. These transport protocols can specify how data is transmitted, including indicating whether any data packets can be received out of order. In cases where this out-of-order transmission is allowed, such as with the Transmission Control Protocol (TCP), some data packets can be received by an end node outside of the specified sequence. Because data packets can be received out of order, end nodes and servers keep track of which packets have arrived and which have not. When a data packet arrives at an end node, the end node sends an acknowledgment (ACK) message to the server, notifying the server that these data packets have arrived. However, this notification process is vulnerable to attack, and attackers can exploit this process to disrupt the functionality of the server. Summary of the invention

[0004] As will be described in greater detail below, the present invention describes methods and systems for mitigating attacks designed to exploit flaws in transport protocol validation systems.

[0005] In one example, a computer-implemented method for mitigating attacks in a computer networking environment includes applying a transport protocol heuristic to a selective acknowledgment (SACK) message received by a network adapter from a network node. The transport protocol heuristic identifies a threshold of an operational function performed when processing the SACK message. The method also includes determining that a threshold of the transport protocol heuristic has been reached by applying the transport protocol heuristic to the SACK message received from the network node. Then, in response to determining that the threshold has been reached, the method includes identifying the network node as a security threat and taking remedial action to mitigate the security threat.

[0006] In some examples, applying the transport protocol heuristic algorithm to the SACK message includes incrementing various counters associated with the operational function when processing the SACK message. The counters indicate when a threshold of the transport protocol heuristic algorithm is reached. In some cases, the counters are modified when an acknowledgment (ACK) message is received.

[0007] In some examples, the security threat is an attacking node that attacks the network computing system. At least one of the remedial measures for mitigating the security threat includes ignoring at least some of the SACK messages received from the network node.

[0008] In some examples, at least one of the thresholds for the operational functions performed when processing the SACK message includes an indication of whether the ACK location is to be moved within a sendmap. At least one of the thresholds for the operational functions performed when processing the SACK message includes a measurement of the distance the ACK location is to be moved within the resulting sendmap. In other cases, at least one of the thresholds for the operational functions performed when processing the SACK message includes an indication of how many SACK messages are received within a specified time period.

[0009] In some examples, the SACK messages are filtered to remove previously received SACK messages. In some examples, filtering the SACK messages further comprises removing duplicate SACK messages. In some examples, at least one of the thresholds for operational functions performed when processing the SACK messages comprises an indication of how many SACK messages were filtered within a specified time period.

[0010] In some examples, determining that a threshold of the transport protocol heuristic algorithm has been reached includes determining that the network node is attempting to confirm that there are multiple different transmission attempts for increasing the size of a transmission map. In some examples, a decay factor is added to the transmission map to reduce one or more counters associated with an ACK or SACK message. In some examples, when the ACK or SACK message is removed, the network node is identified as a security threat. Upon determining that the network node no longer meets the threshold, the network node is subsequently removed from the category classified as a security threat.

[0011] In some examples, the threshold of the operational function executed when processing the SACK message changes dynamically based on the current operating conditions of the network computing system. In other examples, the threshold of the operational function executed when processing the SACK message changes dynamically based on the occurrence of a specified trigger.

[0012] In addition, a corresponding network computing system for mitigating attacks in a computer networking environment includes a network adapter that sends and receives data via a transport protocol, a memory device that at least temporarily stores data received at the network adapter, and a processor that processes at least a portion of the received data. The processor applies a transport protocol heuristic algorithm to a selective acknowledgment (SACK) message received by the network adapter from a network node, wherein the transport protocol heuristic algorithm identifies a threshold of an operational function performed when processing the SACK message. The processor also determines that a threshold of the transport protocol heuristic algorithm has been reached by applying the transport protocol heuristic algorithm to a SACK message received from the network node. Then, in response to determining that the threshold has been reached, the processor identifies the network node as a security threat and takes remedial action to mitigate the security threat.

[0013] In some examples, the above method is encoded as computer-readable instructions on a computer-readable medium. For example, the computer-readable medium includes one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to apply one or more transport protocol heuristic algorithms to a selective acknowledgment (SACK) message received by the network adapter from a network node, the transport protocol heuristic algorithm identifying one or more thresholds of operational functions performed when processing the SACK message; determining that one or more thresholds of the transport protocol heuristic algorithms have been reached by applying the one or more transport protocol heuristic algorithms to the SACK message received from the network node; and in response to determining that one or more of the thresholds have been reached: identifying the network node as a security threat; and taking one or more remedial actions to mitigate the security threat.

[0014] According to the general principles described herein, the features of any embodiments described herein can be used in combination with each other. These and other embodiments, features and advantages will be more fully understood when the following detailed description is read in conjunction with the accompanying drawings and claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The accompanying drawings illustrate several exemplary embodiments and are a part of the specification. Together with the following description, these drawings demonstrate and explain various principles of the present invention.

[0016] Figure 1 is a block diagram of an exemplary content distribution ecosystem.

[0017] Figure 2 yes Figure 1 A block diagram of an exemplary distribution infrastructure within a content distribution ecosystem is shown.

[0018] Figure 3 yes Figure 1 A block diagram of an exemplary content player within a content distribution ecosystem is shown.

[0019] Figure 4 is the computing environment in which the embodiments described herein operate.

[0020] Figure 5 is a flow chart of an exemplary method for mitigating attacks in a packet-switched network.

[0021] Figure 6 is a diagram identifying various counters, quantities, and connection identifiers.

[0022] Figure 7 is a chart that identifies the various thresholds, their current values, and their maximum values.

[0023] Fig. 8A and Figure 8B An embodiment of a delivery map that is updated over time is shown.

[0024] Fig. 9 An embodiment is shown where the message counter is affected by a decay factor before being applied to the send map.

[0025] In all drawings, the same reference numerals and descriptions indicate similar but not necessarily identical elements. Although the exemplary embodiments described herein are susceptible to various modifications and alternative forms, specific embodiments have been shown in the drawings by way of example and will be described in detail herein. However, the exemplary embodiments described herein should not be limited to the specific forms disclosed. On the contrary, the present invention encompasses all modifications, equivalents, and alternatives that fall within the scope of the appended claims. DETAILED DESCRIPTION

[0026] The present invention generally relates to mitigating attacks in packet switching networks. As will be described in more detail below, embodiments of the present invention apply a transport protocol heuristic algorithm to a selective acknowledgment (SACK) message received by a network adapter from a network node. The transport protocol heuristic algorithm identifies a threshold of operational functions performed when processing a SACK message. These embodiments also determine that a threshold of the transport protocol heuristic algorithm has been reached by applying the transport protocol heuristic algorithm to a SACK message received from a network node. Then, in response to determining that the threshold has been reached, the network node is identified as a security threat, and remedial action is taken to mitigate the threat.

[0027] In traditional packet switching networks, attackers often try to exploit weaknesses in network design. For example, as described above in the Transmission Control Protocol (TCP), some data packets sent by the server may be received out of order at the receiving end (recipient). Data packets often take a circuitous route on the Internet to reach their destination. Some links on this route may be faster than other links. Therefore, some data packets may arrive at the receiving device (e.g., terminal node) out of order, or may be lost completely and may not arrive at the receiving device (e.g., due to router overload). Since data packets are often received out of order, the terminal node sends a confirmation message to the server to track which data packets have arrived and which have not arrived. These marks are usually maintained by the server in a sending map, scoreboard, data tree or other data structure. As used herein, "sending map" refers to a data map that tracks which data has been sent to peer nodes. This sending map is used to process inbound confirmations from these peer nodes. In the embodiments described herein, a data tree or other data structure can be used to replace or supplement the sending map.

[0028] As packets transmitted from the server arrive at the end node, the end node sends various types of acknowledgment (ACK) messages to the server to notify the server that these data packets have arrived. A selective ACK (SACK) message acknowledges the receipt of a specific out-of-order message, while an ACK message acknowledges the receipt of all previous messages up to the ACK message. Thus, if a file is segmented into, for example, 10 different packets for transmission, a SACK message transmitted by the receiving end node may indicate that packet 5 has arrived, while an ACK message for packet 3 transmitted by the receiving end node may indicate that all packets 1-3 have been received. The send map may note that packets 1-3 and packet 5 have been received, while the status of packets 4 and 6-10 is unknown.

[0029] Of course, in the real world, thousands, millions, or billions of different packets may be sent and received during a TCP connection. As a result, the server may receive an extremely large number of ACK and SACK messages. An attacker may take advantage of this fact and try to overload the server by sending an excessive amount of ACK / SACK messages. By sending a large number of ACK / SACK messages, the send map may grow larger and larger until it becomes unmanageable and the server becomes unresponsive because all of its computing power is used to maintain the growing send map.

[0030] Some traditional solutions to thwart these types of attacks include placing a limit on the total number of send map entries. Such solutions simply identify a hard number and do not allow any send map entries beyond that number to be created. However, send maps operate on the assumption that they will be able to create new entries for every new send and retransmission. Because every send needs to be tracked in the TCP connection, if a send map entry cannot be created, the server will not send data packets, thereby preventing or severely limiting the amount of data that can be transmitted. Other traditional solutions place a limit on the number of send map entries that can be allocated with SACKs. If additional SACK messages come in, and the limit is reached, the server will begin to drop SACK information. This greatly degrades the performance of the server.

[0031] The embodiments described herein avoid these disadvantages by establishing transport protocol heuristics that identify activities performed by attackers. These transport protocol heuristics are configured to identify these malicious activities without the need to set limits on sending map entries or setting limits on SACKs. Once established, the transport protocol heuristics observe certain activities by establishing limits on certain operations that occur when processing data packet acknowledgments. When these limits are reached, the system described herein takes remedial measures, including monitoring activity from certain nodes and limiting the number of operations (e.g., sending map moves) that can be performed on acknowledgment messages received from this node. These embodiments can be used in conjunction with any transport protocol, including TCP, User Datagram Protocol (UDP), Reliable Data Protocol (RDP), or other transport protocols.

[0032] In some cases, applying the transport protocol heuristic algorithm to the SACK message includes incrementing various counters associated with the operating function when processing the SACK message. The counter indicates when a threshold of the transport protocol heuristic algorithm is reached. In some cases, the counter is modified when an acknowledgment (ACK) message is received.

[0033] At least one of the remedial measures for mitigating the security threat includes ignoring at least some of the SACK messages received from the network node. In some examples, at least one of the thresholds for the operational functions performed when processing the SACK messages includes an indication of whether the ACK location is to be moved within the transmit map. In other cases, the threshold includes a measurement of the distance the ACK location is to be moved within the transmit map. In other cases, the threshold includes an indication of how many SACK messages are received within a specified time period.

[0034] In some cases, the SACK messages are filtered to remove previously received SACK messages or to remove duplicate SACK messages. In some cases, the threshold includes an indication of how many SACK messages were and were not filtered within a specified time period.

[0035] In some cases, determining that a threshold of a transport protocol heuristic algorithm has been reached includes determining that the network node is attempting to confirm that there are multiple different transmission attempts for increasing the size of the transmission map. In some embodiments, before processing a new ACK or SACK message, a decay factor is added to the transmission map to reduce the obsolete ACK or SACK count. While reducing the obsolete ACK or SACK count, the network node can be identified as a security threat. After determining that the network node no longer meets the threshold, the network node is then removed from the category classified as a security threat.

[0036] In some cases, the threshold of the operational function executed when processing the SACK message changes dynamically based on the current operating conditions of the network computing system. In other cases, the threshold of the operational function executed when processing the SACK message changes dynamically based on the occurrence of a specified trigger.

[0037] Because many of the embodiments described herein can be used with substantially any type of computing network, including a distributed network designed to provide video content to a global audience, various computer networks and video distribution systems will be first referenced. Figure 1-Figure 3 These figures describe the various networks and distribution methods used to deliver video content to users. Figure 4-Figure 9 A more specific embodiment will be described in which transport protocol heuristics are applied to acknowledgement messages sent and received over such a network to identify attacking nodes and take remedial action to mitigate or prevent the attack.

[0038] Figure 1 1 is a block diagram of a content distribution ecosystem 100, which includes a distribution infrastructure 110 in communication with a content player 120. In some embodiments, the distribution infrastructure 110 may be configured to encode data and transmit the encoded data to the content player 120 via data packets. The content player 120 may be configured to receive the encoded data via the distribution infrastructure 110 and decode the data for playback to a user. The data provided by the distribution infrastructure 110 may include audio, video, text, images, animations, interactive content, tactile data, virtual or augmented reality data, location data, game data, or any other type of data that may be provided via streaming.

[0039] The distribution infrastructure 110 generally represents any service, hardware, software, or other infrastructure component configured to deliver content to an end user. For example, the distribution infrastructure 110 may include a content aggregation system, a media transcoding and packaging service, a network component (e.g., a network adapter), and / or various other types of hardware and software. The distribution infrastructure 110 may be implemented as a highly complex distribution system, a single media server or device, or anything in between. In some examples, regardless of size or complexity, the distribution infrastructure 110 may include at least one physical processor 112 and at least one memory device 114. One or more modules 116 may be stored or loaded into the memory 114 to implement adaptive streaming, as discussed herein.

[0040] Content player 120 generally represents any type or form of device or system capable of playing audio and / or video content that has been provided through distribution infrastructure 110. Examples of content player 120 include, but are not limited to, mobile phones, tablet computers, laptop computers, desktop computers, televisions, set-top boxes, digital media players, virtual reality helmets, augmented reality glasses, and / or any other type or form of device capable of presenting digital content. Like distribution infrastructure 110, content player 120 may include a physical processor 122, a memory 124, and one or more modules 126. Some or all of the adaptive streaming processes described herein may be performed or enabled by module 126, and in some examples, module 116 of distribution infrastructure 110 may coordinate with module 126 of content player 120 to provide adaptive streaming of multimedia content.

[0041] In certain embodiments, Figure 1 One or more of the modules 116 and / or 126 in the embodiment may represent one or more software applications or programs that, when executed by a computing device, may cause the computing device to perform one or more tasks. For example, as will be described in more detail below, one or more of the modules 116 and 126 may represent modules stored and configured to run on one or more general-purpose computing devices. Figure 1 One or more of the modules 116 and 126 in may also represent all or part of one or more special purpose computers configured to perform one or more tasks.

[0042] In addition, one or more of the modules, processes, algorithms, or steps described herein may convert data, a physical device, and / or a representation of a physical device from one form to another. For example, one or more of the modules described herein may receive defect identification data, convert the defect identification data by preparing the defect identification data for presentation in an interactive user interface, provide the results of the conversion to the interactive user interface, and present the converted defect identification data on the interactive user interface. Additionally or alternatively, one or more of the modules described herein may convert a processor, volatile memory, non-volatile memory, and / or any other portion of a physical computing device from one form to another by executing on a computing device, storing data on a computing device, and / or otherwise interacting with a computing device.

[0043] Physical processors 112 and 122 generally represent any type or form of hardware-implemented processing unit capable of interpreting and / or executing computer-readable instructions. In one example, physical processors 112 and 122 can access and / or modify one or more of modules 116 and 126, respectively. In addition or alternatively, physical processors 112 and 122 can execute one or more of modules 116 and 126 to facilitate adaptive streaming of multimedia content. Examples of physical processors 112 and 122 include, but are not limited to, microprocessors, microcontrollers, central processing units (CPUs), field programmable gate arrays (FPGAs) implementing soft-core processors, application-specific integrated circuits (ASICs), portions of one or more thereof, variations or combinations of one or more thereof, and / or any other suitable physical processors.

[0044] The memories 114 and 124 generally represent any type or form of volatile or non-volatile storage device or medium capable of storing data and / or computer-readable instructions. In one example, the memories 114 and / or 124 can store, load, and / or maintain one or more of the modules 116 and 126. Examples of memories 114 and / or 124 include, but are not limited to, random access memory (RAM), read-only memory (ROM), flash memory, hard disk drive (HDD), solid-state drive (SSD), optical drive, cache, variations or combinations of one or more thereof, and / or any other suitable memory device or system.

[0045] Figure 22 is a block diagram of exemplary components of content distribution infrastructure 110 according to certain embodiments. Distribution infrastructure 110 may include storage 210, services 220, and network 230. Storage 210 generally represents any device, collection of devices, and / or system capable of storing content for delivery to end users. Storage 210 may include a central repository with devices capable of storing terabytes or petabytes of data, and / or may include a distributed storage system (e.g., an appliance that mirrors or caches content at Internet interconnected locations to provide fast access to mirrored content in certain areas). Storage 210 may also be configured in any other suitable manner.

[0046] As shown, storage device 210 may store, among other items, content 212, user data 214, and / or log data 216. Content 212 may include television programs, movies, video games, user-generated content, and / or any other suitable type or form of content. User data 214 may include personally identifiable information (PII), payment information, preferences, language and accessibility settings, and / or any other information associated with a particular user or content player. Log data 216 may include viewing history information, network throughput information, and / or any other metrics associated with a user's connection to or interaction with distribution infrastructure 110.

[0047] Services 220 may include personalization services 222, transcoding services 224, and / or packaging services 226. Personalization services 222 may personalize recommendations, content streams, and / or other aspects of a user's experience with distribution infrastructure 110. Encoding services 224 may compress media at different bit rates, which may enable real-time switching between different encodings. Packaging services 226 may package the encoded video for streaming before deploying it to a delivery network (such as network 230).

[0048] Network 230 generally refers to any medium or architecture capable of facilitating communication or data transmission. Network 230 may facilitate communication or data transmission via transmission protocols using wireless and / or wired connections. Examples of network 230 include, but are not limited to, an intranet, a wide area network (WAN), a local area network (LAN), a personal area network (PAN), the Internet, power line communications (PLC), a cellular network (e.g., a Global System for Mobile Communications (GSM) network), portions of one or more thereof, variations or combinations of one or more thereof, and / or any other suitable network. For example, Figure 2 As shown, network 230 may include an Internet backbone 232 , an Internet service provider 234 , and / or a local network 236 .

[0049] Figure 3 yes Figure 1The content player 120 generally represents any type or form of computing device capable of reading computer-executable instructions. The content player 120 may include, but is not limited to, a laptop computer, a tablet computer, a desktop computer, a server, a mobile phone, a multimedia player, an embedded system, a wearable device (e.g., a smart watch, smart glasses, etc.), a smart car, a game console, an Internet of Things (IoT) device (such as a smart appliance), a variation or combination of one or more thereof, and / or any other suitable computing device.

[0050] like Figure 3 As shown, in addition to the processor 122 and the memory 124, the content player 120 may also include a communication infrastructure 302 and a communication interface 322 coupled to a network connection 324. The content player 120 may also include a graphics interface 326 coupled to a graphics device 328, an input interface 334 coupled to an input device 336, and a storage interface 338 coupled to a storage device 340.

[0051] Communications infrastructure 302 generally represents any type or form of infrastructure capable of facilitating communications between one or more components of a computing device. Examples of communications infrastructure 302 include, but are not limited to, any type or form of communications bus (e.g., a peripheral component interconnect (PCI) bus, a PCI Express (PCIe) bus, a memory bus, a front-side bus, an integrated drive electronics (IDE) bus, a control or register bus, a host bus, etc.).

[0052] As described above, memory 124 generally represents any type or form of volatile or non-volatile storage device or medium capable of storing data and / or other computer-readable instructions. In some examples, memory 124 can store and / or load operating system 308 for execution by processor 122. In one example, operating system 308 can include and / or represent software that manages computer hardware and software resources and / or provides common services to computer programs and / or applications on content player 120.

[0053] The operating system 308 may perform various system management functions, such as managing hardware components (e.g., graphics interface 326, audio interface 330, input interface 334, and / or storage interface 338). The operating system 308 may also handle the memory management model of the playback application 310. The modules of the playback application 310 may include, for example, a content buffer 312, an audio decoder 318, and a video decoder 320.

[0054] The playback application 310 may be configured to retrieve digital content via the communication interface 322 and to play the digital content via the graphics interface 326. The video decoder 320 may read video data units from the video buffer 316 and may output the video data units in a sequence of video frames whose duration corresponds to a fixed span of playback time. Reading the video data units from the video buffer 316 may effectively dequeue the video data units from the video buffer 316. The sequence of video frames may then be rendered by the graphics interface 326 and transmitted to the graphics device 328 for display to a user.

[0055] In the case of limited and / or variable bandwidth of the distribution infrastructure 110, the playback application 310 can download and buffer successive portions of video data and / or audio data from video encodings utilizing different bit rates based on various factors (e.g., scene complexity, audio complexity, network bandwidth, device capabilities, etc.). In some embodiments, video playback quality can take precedence over audio playback quality. Audio playback and video playback quality can also be balanced with each other, and in some embodiments, audio playback quality can take precedence over video playback quality.

[0056] The content player 120 may also include a storage device 340 coupled to the communication infrastructure 302 via a storage interface 338. The storage device 340 generally represents any type or form of storage device or medium capable of storing data and / or other computer-readable instructions. For example, the storage device 340 may be a disk drive, a solid-state drive, an optical drive, a flash drive, etc. The storage interface 338 generally represents any type or form of interface or device for transferring data between the storage device 340 and other components of the content player 120.

[0057] Many other devices or subsystems may be included in or connected to the content player 120. Figure 3 One or more of the components and devices shown in the drawings need not be present to implement the embodiments described and / or illustrated herein. The devices and subsystems mentioned above may also be used in conjunction with Figure 3 The content player 120 may also be implemented in any number of software, firmware, and / or hardware configurations.

[0058] Figure 4A computing environment 400 is shown that includes a network computing system 401. The network computing system 401 can be substantially any type of computing system, including a local computing system or a distributed (e.g., cloud) computing system. The network computing system 401 can include at least one processor 402 and at least some system memory 403. The computer system 401 can include program modules for performing a variety of different functions. These program modules can be hardware-based, software-based, or can include a combination of hardware and software. Each program module can use computing hardware and / or software to perform specified functions, including those described below.

[0059] The network computing system 401 also includes a network adapter 404, which is configured to communicate with other computer systems. The network adapter 404 may include any wired or wireless communication device that can receive data from other computer systems and / or transmit data to other computer systems. These communication devices may include hardware interfaces, including Ethernet adapters, WIFI adapters, hardware radios, including, for example, hardware-based receivers 405, hardware-based transmitters 406, or hardware-based combined transceivers that can simultaneously receive and transmit data. The radio may be a cellular radio, a Bluetooth radio, a global positioning system (GPS) radio, or other types of radios. The network adapter 404 may be configured to interact with a database, a mobile computing device (such as a mobile phone or tablet computer), an embedded or other type of computing system.

[0060] The network computing system 401 also includes a transport protocol heuristic algorithm module 407. The transport protocol heuristic algorithm module 407 generates heuristic algorithms 408, which have one or more thresholds 409. For example, when the network computing system 401 processes incoming data 416 including an ACK message 417, a SACK message 418, or other type of acknowledgment (e.g., a negative acknowledgment (NACK)), the network computing system 401 takes certain actions. As described above, one of these actions includes creating or updating a send map entry. When a computing system (e.g., a personal computer 414 or a mobile device 415) sends an ACK 417 or a SACK 418, the network computing system 401 updates its send map. In some embodiments, the network computing system 401 also analyzes heuristic algorithms 408 designed to detect malicious activity.

[0061] One of these heuristic algorithms considers the ratio of ACK messages to SACK messages sent by the receiving node. For example, if the network computing system 401 is a server that transmits data 416 (e.g., video content) to a user's mobile device 415, this mobile device will send a combination of ACK and SACK messages to the network computing system 401 over time. The ACK and SACK messages are not necessarily sent together, but over time, the network computing system 401 can detect a pattern in the ratio of ACK to SACK. If the mobile device 415 sends many more SACKs than ACKs, this high ratio of SACK to ACK can indicate that this mobile device is an attacking node. At this point, the network computing system 401 marks the mobile device 415 as an attacking node, or the network computing system waits and analyzes other heuristic algorithms related to this mobile device before marking this device as an attacker.

[0062] Another heuristic 408 considered by the network computing system 401 is the number of moves caused by ACK and SACK messages. For example, when the network computing system 401 receives an ACK 417 or SACK message 418, the system determines whether it needs to move a pointer in the send map along the send map to indicate that all previous data packets have been received at the terminal node (e.g., mobile device 415). Moving the pointer requires computation by the network computing system 401, and therefore, too many moves will require too much computation. If there are too many moves on a given send map, the movement of the send map can overcome the resources of the network computing system 401, and communications may slow to a crawl or stop. Therefore, in the embodiments described herein, the network computing system 401 monitors the number of send map moves caused by each terminal node. If one terminal node causes too much movement, the threat mitigation module 412 of the network computing system 401 can stop responding to ACKs and SACKs from this terminal node, or other mitigation measures 413 can be taken. These concepts will be discussed below with respect to Figure 5 The method 500 is further described.

[0063] Figure 5 is a flow chart of an exemplary computer-implemented method 500 for mitigating attacks in a packet-switched network. Figure 5 The steps shown in the figure may be executed by any suitable computer executable code and / or computing system (including Figure 4 In one example, Figure 5 Each step shown in may represent an algorithm, the structure of which includes and / or is represented by multiple sub-steps, examples of which are provided in more detail below.

[0064] like Figure 5 As shown in step 510 of method 500, Figure 4 The network computing system 401 applies one or more transport protocol heuristics 408 to SACK messages 418 received by the network adapter 404 from a network node (e.g., 415). The transport protocol heuristics 408 may identify thresholds 409 for operational functions performed when processing SACK messages. These thresholds may include any one or more of the following: an ACK move threshold that identifies a threshold number of transmit map pointer movements that are allowed; an ACK-to-SACK threshold that identifies a ratio of received ACK messages to SACK messages; a SACK-to-move threshold that identifies instances where a SACK message causes a transmit map pointer movement (or "movement" herein) and instances where a SACK message does not cause a movement; a recovery threshold that identifies whether an attacker's assertion is a false positive; and a map minimum threshold that identifies a minimum count of transmit map entries in a list stored on the network computing system (e.g., a list 421 on a data store 420). It will be appreciated that many different thresholds 409 may be used in the transport protocol heuristics, and that the above thresholds are examples of such values ​​and are not intended to be limiting.

[0065] In step 520 of method 500, Figure 4 The threshold monitoring module 410 determines that a threshold 409 of at least one of the transport protocol heuristic algorithms has been reached by applying the transport protocol heuristic algorithm 408 to the SACK message 418 received from the network node (e.g., 415). The threshold monitoring module 410 is configured to monitor the thresholds and determine when these values ​​have been exceeded. In some embodiments, counters corresponding to the thresholds are instantiated. With each occurrence of a message processing event (e.g., sending a map move event), the counter associated with this operation is incremented. After many consecutive increments, the threshold monitoring module 410 can determine that the value of the counter has exceeded the established threshold 409 of this counter.

[0066] In response to determining that one or more of the thresholds 409 have been reached, the security threat identification module 411 identifies the network node (e.g., 415) as a security threat at step 530, and the threat mitigation module 412 takes one or more remedial mitigation measures 413 to reduce or eliminate the security threat at step 540. The mitigation measures 413 may include completely ignoring ACK / SACK messages from the security threat in response to fewer ACK / SACK messages received from the security threat, reducing the number or type of operations performed in response to ACK / SACK messages from the security threat (e.g., performing fewer send map movement operations or creating fewer ACK / SACK entries in the send map), filtering ACK / SACKs, introducing an attenuation factor when processing ACK / SACK messages, or taking other mitigation measures. In some cases, the security threat identification module 411 continues to monitor nodes that have been branded as security threats. Over time, if the threshold 409 of this node returns to a normal expected range, this node can be reclassified as a non-threat node.

[0067] In some embodiments, as described above, these thresholds 409 are associated with counters. Figure 6 As shown, different counters in diagram 600 track different operations. When these operations occur (e.g., the send map pointer is moved), the counter 601 associated with this operation is incremented. Network computing system 401 establishes counters, such as an ACK_Total counter, indicating the total number of ACK messages received from a certain node. The connection identifying the sender and the receiver can be identified by a connection identifier 603. For example, if Figure 4 If the mobile handset 415 of the present invention is identified as "A" and the network computing system 401 is identified as "B", then this connection may be referred to as "AB". In the event that these devices have multiple transport protocol connections (simultaneously or continuously), the connection identifier 603 may include a number, such as, "AB1" or "AB2", etc. Thus, a unique set of counters 601 may apply to each connection between the nodes (e.g., "AB1"), or the counters may apply to all connections between node A and node B. Thus, as communications are transmitted back and forth between the server and the end node, the counters 601 track various thresholds over time.

[0068] In graph 600, counter ACK_Total indicates how many ACK messages network computing node 401 has received, as indicated by number 602. The current number is 62, indicating that network computing node 401 has received 62 ACK messages from node "B". The SACK_Total counter shows a count of 53 SACK messages received, while the Moved counter shows a count of 14 Send Map Pointer moves. A large number of "Moves" can indicate that the SACK messages are non-compliant and are part of an attack from a security threat. The No_Move counter tracks the number of times a SACK message has been received without moving the Send Map Pointer. Most SACK messages result in "No Moves", so a low count of "No Moves" generally indicates that message transmission is functioning properly. When network computing node 401 receives ACK, SACK, or other acknowledgment messages, network computing node 401 adds these messages to the total and notes when the Send Map Pointer was moved, incrementing the associated counter each time these operational functions are performed. It will be appreciated that many different types of counters may be instantiated to track different types of messages and different types of operations performed in response to those messages.

[0069] Figure 7 A diagram 700 is shown with different threshold values ​​701 and their associated current values ​​702 and maximum values ​​703. As the name implies, the current value 702 shows the current value of the corresponding threshold of the counter. The maximum value 703 indicates the maximum allowed value of this threshold. Once the increment of this threshold of the counter exceeds the maximum value 703, Figure 4 The threshold monitoring module 410 indicates that the threshold 701 has been reached. The threshold 701 represents a sample of potential transport protocol heuristics that can be tracked and monitored by the network computing system 401.

[0070] exist Figure 7 ACK_Movement_Threshold identifies the threshold number of transmit map pointer movements allowed within a given time frame. The current value 702 is 27, indicating that 27 transmit map pointer movements have occurred within the given time frame or since the specified event occurred. Once the maximum value of 50 is reached, Figure 4The security threat identification module 411 will identify the terminal node (e.g., personal computer 414) as a security threat. ACK_to_SACK_Threshold identifies the ratio of ACK messages to SACK messages received from the terminal node within a specified time frame or since a specified event occurred. SACK_to_Move_Threshold identifies instances where a SACK message caused the sending map pointer to move and instances where a SACK message did not cause movement.

[0071] SACK_to_Move_Threshold can be a percentage of SACK moves to no-moves (e.g., Figure 7 ), and when this threshold percentage is exceeded, the security threat identification module 411 identifies the terminal node as a security threat. Restoral_Threshold identifies the percentage that indicates whether the attacker's statement is a false positive, and Map_Minimum threshold identifies the minimum count of sent map entries stored before starting to determine whether the terminal node is a security threat. As with the counters identified above, it will be understood that the identified threshold 701 represents a sample of potential transmission protocol heuristics that can be tracked and monitored by the network computing system 401, and other thresholds can be used in combination with the listed thresholds, or as an alternative to the listed thresholds.

[0072] In some cases, upon receiving certain types of acknowledgment messages, the current value of the counter may be modified or even reset to zero. For example, upon receiving ACK message 417 from computer system 414, network computing system 401 may modify the count of acknowledgment messages such as ACK_Total in counter 601. If an end node is sending an excessive number of ACK messages or SACK messages, threshold monitoring module 410 will determine that a threshold has been exceeded and security threat identification module 411 will identify the end node as a threat.

[0073] Fig. 8A An embodiment of a transmission map 800A is shown with multiple entries identifying transmitted packets 801. When an ACK message is received at the network adapter 404, the network computing system 401 acknowledges each of the previously transmitted messages up to the ACK message 802. Fig. 8A and Figure 8BIn the example, acknowledged messages are indicated by backward-leaning shading, selectively acknowledged messages are indicated by forward-leaning shading, and unacknowledged packets are unshaded. At 803, network computing system 401 receives a SACK message 803 acknowledging receipt of this packet. SACK message 804 similarly acknowledges receipt of the out-of-order received packet. When ACK message 805 is received, the ACK indicates that all data packets 801 up to ACK 805 have been received. Thus, as shown in FIG. Figure 8B As shown, all packets 801 up to the ACK 805 are shaded as acknowledged. A newly received SACK message 806 indicates that another out-of-order packet has been selectively acknowledged.

[0074] When an ACK is moved (e.g., from 802 to 805), the "Move" counter is incremented by 1. In some embodiments, excessive send map move operations (e.g., exceeding Figure 7 The ACK_Movement_Threshold of ACK_Movement_Threshold indicates that the terminal node is a security threat, and the security threat identification module 411 marks the terminal node as a threat. In some cases, the network computing system 401 can determine the distance that the ACK position will move. Fig. 8A 802 moves up nine positions to the group specified by ACK message 805. A large number of short moves received from a terminal node may indicate a potential attack. Therefore, one of the operational functions performed when processing a SACK message includes measuring the distance the ACK position will move within the transmission map (e.g., 800A / 800B). In addition, if a large number of SACK messages are received in a short period of time, the security threat identification module 411 will also mark the terminal node as a threat.

[0075] Once the network computing system 401 marks a terminal node as a threat, the threat mitigation module 412 takes various mitigation measures 413 to reduce or eliminate the threat posed by the terminal node. One mitigation measure is to completely cut off communication with the terminal node. Another mitigation measure is to ignore all or part of the SACK messages received from the terminal node. Another mitigation measure is to ignore other types of ACK messages, or only respond to certain ACK messages. By ignoring some or all of these ACK / SACK messages from the terminal node, the network computing system 401 will stop using so many computing resources to maintain the send map, effectively eliminating this attack line. The processor 402 continues to run at a healthy rate and is not overly committed to processing requests from the attacking node.

[0076] Fig. 9 An embodiment of filtering SACK messages before processing the SACK messages is shown. This filtering can be performed before detecting security threats. In one embodiment, at a server (e.g., Figure 4The server receives SACK messages 901 at a network computing system 401. The server applies a filter 902 to filter one or more of the SACK messages 901 so that the server does not process the filtered SACK messages (e.g., does not update the send map 904). The filter 902 can also be used to remove previously received SACK messages or to remove duplicate SACK messages. The filtered messages are filtered before being processed at the send map 904, so no processing resources are used to process these messages to update the send map. Therefore, this type of filtering can save a lot of CPU and memory overhead that would otherwise be used to process the SACK messages 901. In some cases, the network computing system 401 tracks how many SACK messages have been filtered within a specified time period and uses this number to determine whether a particular terminal node is attempting an attack.

[0077] The decay factor 903 is used to more quickly identify attacking nodes. The decay factor 903 is applied to the counter (e.g., Figure 7 702) to uniformly decrease the count of the counter, thereby reducing the amount of time required to reach a threshold amount. For example, if an attacker sends a large number of ACKs (e.g., 50,000 ACKs) in an attempt to quickly increase the size of the send map window, the ACK-to-SACK ratio will be very large and therefore may remain below a given ACK-to-SACK ratio threshold (e.g., 60%). While the ratio is below this threshold, the attacker can continue to send ACK messages to expand the send map window. However, by uniformly applying a decay factor 903 to the counter at a specified time increment (e.g., every second), the counter will decrease by ½ or ¼ or other ratio.

[0078] Because all counters are reduced by the same decay ratio, the ACK-to-SACK ratio also remains constant. For instance, in the example above, if 100 SACKs were received along with 50,000 ACKs, the ACK-to-SACK ratio would be 50,000:100. If a decay factor of ¼ was applied, each counter would be reduced to ¼ of its original value, so 12,500:25. Further reductions in counter values ​​can bring the ACK-to-SACK ratio closer to an established ACK-to-SACK ratio threshold (e.g., 60% ACK to SACK). Once the ACK-to-SACK ratio threshold is reached, the system takes mitigation actions to neutralize the attacker. Reaching this threshold in a more efficient manner allows attackers to be identified and blocked more quickly.

[0079] In some cases, Figure 4The security threat identification module 411 is configured to identify a terminal node (e.g., 415) as a security threat while removing obsolete ACK or SACK messages. For example, the security threat identification module 411 may consult a counter to determine that the terminal node 415 is sending a number of ACK / SACK messages that exceeds a threshold amount. The network computing system 401 can ensure that old ACK / SACK messages are properly processed before processing new messages. When processing old, possibly obsolete ACK / SACK messages, the network computing system 401 can simultaneously determine that the terminal node 415 is a security threat.

[0080] However, in some cases, the terminal node 415 does not intend to attack the network computing system 401. For example, the ACK / SACK message sent by the terminal node 415 may be delayed due to a faulty or low-bandwidth network link. For example, the network may be severely congested or may be experiencing some type of interference. Therefore, the ACK / SACK message may arrive in a large bundle. The security threat identification module 411 can mark the terminal node 415 as a security threat and initiate one or more mitigation measures 413. However, the network computing system 401 will continue to monitor the terminal node 415, and if over time, the confirmation messages sent by the node 415 return to a normal level below a predetermined threshold, the security threat identification module will reclassify this node as no longer a security threat.

[0081] Further, the thresholds themselves may change over time. In such cases, a terminal node that was classified as exceeding one or more thresholds may no longer exceed those thresholds. Thus, the terminal node may be reclassified as a non-threatening node. Threshold 409 may change, for example, due to current operating conditions at network computing system 401. For example, if network computing system 401 is under a high CPU load, threshold 409 may be dynamically lowered. Alternatively, if network computing system 401 is experiencing a light load, threshold 409 may be dynamically raised as more computing power is available to process sending map changes.

[0082] With higher thresholds, there is a lower likelihood of misidentifying a terminal node as a security threat and reducing or eliminating its current service level. For example, if the SACK-to-ACK ratio is set to 99%, it may take longer to identify an attacker, but the network computing system 401 is less likely to make a false detection. In addition or alternatively, the size of the send map (or data tree) can be considered. For example, most endpoints that do not experience high levels of data loss will have a very small send map. Therefore, if the threshold for the number of send map entries required to begin monitoring is increased, the increased limit can eliminate a large number of connections that would typically reach a high SACK-to-ACK ratio during loss recovery. However, because the size of the send map is still relatively small, the computational burden of maintaining this send map is still low. Therefore, even if the SACK-to-ACK ratio is relatively high, the sending node will not be identified as an attacker because the size is below a certain threshold size.

[0083] Thus, network computing system 401 may change threshold 409 over time based on different conditions or triggering events. In some cases, the thresholds for each counter are specified in policies. These policies may be defined by Figure 4 The threshold update module 419 updates the threshold value specified in the policy. Then, when determining whether the threshold value has been exceeded, the threshold monitoring module 410 implements the updated threshold value 422 specified in the policy. The threshold value can also be changed to change the speed at which an attacker is identified, or to change the speed at which a non-threatening node with a bad connection providing a large number of ACK / SACKs is correctly classified as a non-threatening node. Thus, the threshold value can be set and forgotten, or can be dynamically changed based on current conditions such as CPU or memory bandwidth, or the occurrence of a specified trigger event (e.g., receiving a packet from a node in a specified country, or from a specified browser, or from a specific IP address library, etc.).

[0084] In one embodiment, the network computing system on which method 500 operates includes a network adapter that sends and receives data via a transport protocol, a memory device that at least temporarily stores data received at the network adapter, and a processor that processes at least a portion of the received data, including: applying one or more transport protocol heuristic algorithms to a selective acknowledgment (SACK) message received by the network adapter from a network node, wherein the transport protocol heuristic algorithm identifies one or more thresholds of operational functions performed when processing the SACK message, determining that one or more of the thresholds of the transport protocol heuristic algorithms have been reached by applying the one or more transport protocol heuristic algorithms to the SACK message received from the network node; and in response to determining that one or more of the thresholds have been reached, identifying the network node as a security threat and taking one or more remedial measures to mitigate the security threat.

[0085] The corresponding non-transitory computer-readable medium includes one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to: apply one or more transport protocol heuristic algorithms to a selective acknowledgment (SACK) message received by a network adapter from a network node, wherein the transport protocol heuristic algorithms identify one or more thresholds of operational functions performed when processing SACK messages, determine that one or more of the thresholds of the transport protocol heuristic algorithms have been reached by applying the one or more transport protocol heuristic algorithms to the SACK message received from the network node, and in response to determining that one or more of the thresholds have been reached, identify the network node as a security threat and take one or more remedial actions to mitigate the security threat.

[0086] Thus, the methods and systems described herein are capable of detecting attackers using a variety of different transport protocol heuristics. These heuristics define thresholds for certain actions taken upon receiving an acknowledgment message. Once these thresholds are reached, the node is identified as an attacker and monitored for future malicious activity. If the node's activity returns to normal, the node is no longer classified as a threat node. In addition, if the system's ability to process messages increases or if other policy conditions are met, the thresholds can be changed and nodes that were once classified as threat nodes are no longer classified as threat nodes. When providing this functionality, no limit is set on the total number of sent map entries, nor is there a limit on the number of sent map entries that can be allocated with SACKs.

[0087] Example Embodiment:

[0088] Example 1. A network computing system comprising: a network adapter that sends and receives data via a transport protocol; a memory device that at least temporarily stores data received at the network adapter; a processor that processes at least a portion of the received data, comprising: applying one or more transport protocol heuristic algorithms to a selective acknowledgment (SACK) message received by the network adapter from a network node, the transport protocol heuristic algorithm identifying one or more thresholds of operational functions performed when processing the SACK message; determining that one or more thresholds of the transport protocol heuristic algorithms have been reached by applying the one or more transport protocol heuristic algorithms to the SACK message received from the network node; and in response to determining that one or more of the thresholds have been reached: identifying the network node as a security threat; and taking one or more remedial measures to mitigate the security threat.

[0089] Example 2. The network computing system of Example 1, wherein applying the one or more transport protocol heuristics to the SACK message comprises incrementing one or more counters associated with the operational function while processing the SACK message.

[0090] Example 3. The network computing system of Example 2, wherein the counter indicates when a threshold of one or more of the transport protocol heuristics is reached.

[0091] Example 4. The network computing system of Example 2, wherein one or more of the counters are modified upon receipt of an acknowledgement (ACK) message.

[0092] Example 5. The network computing system of Example 1, wherein the security threat comprises an attacking node that attacks the network computing system.

[0093] Example 6. The network computing system of Example 1, wherein at least one of the one or more remedial measures for mitigating the security threat comprises ignoring at least some of the SACK messages received from the network nodes.

[0094] Example 7. A network computing system according to Example 1, wherein at least one of the thresholds of the operational functions performed when processing the SACK message includes an indication of whether the ACK position is to be moved within the transmission map.

[0095] Example 8. A network computing system according to Example 7, wherein at least one of the thresholds of the operational functions performed when processing the SACK message includes a measurement result of the distance that the ACK location is to move within the transmission map.

[0096] Example 9. The network computing system of Example 1, wherein at least one of the thresholds for operational functions performed when processing the SACK message includes an indication of how many SACK messages are received within a specified time period.

[0097] Example 10. The network computing system of Example 1, further comprising filtering the SACK message to remove previously received SACK messages.

[0098] Example 11. The network computing system of Example 10, wherein filtering the SACK messages further comprises removing duplicate SACK messages.

[0099] Example 12. The network computing system of Example 10, wherein at least one of the thresholds for operational functions performed when processing the SACK message includes an indication of how many SACK messages were filtered within a specified time period.

[0100] Example 13. A computer-implemented method comprising the steps of: applying one or more transport protocol heuristic algorithms to a selective acknowledgment (SACK) message received by a network adapter from a network node, the transport protocol heuristic algorithms identifying one or more thresholds of operational functions performed when processing the SACK message; determining that one or more thresholds of the transport protocol heuristic algorithms have been reached by applying the one or more transport protocol heuristic algorithms to the SACK message received from the network node; and in response to determining that one or more of the thresholds have been reached: identifying the network node as a security threat; and taking one or more remedial actions to mitigate the security threat.

[0101] Example 14. The computer-implemented method of Example 13, wherein determining that a threshold of one or more of the transport protocol heuristics has been reached comprises determining that the network node is attempting to confirm a number of transmission attempts to increase the size of a transmission map.

[0102] Example 15. The computer-implemented method of Example 14, further comprising adding a decay factor to the transmit map to reduce one or more counters associated with the ACK or SACK message.

[0103] Example 16. The computer-implemented method of Example 15, wherein the network node is identified as a security threat when the ACK or SACK message is removed.

[0104] Example 17. The computer-implemented method of Example 16, wherein upon determining that the network node no longer satisfies the threshold, the network node is subsequently removed from the category classified as a security threat.

[0105] Example 18. A computer-implemented method according to Example 13, wherein at least one of the thresholds of operational functions performed when processing the SACK message changes dynamically based on one or more current operating conditions of the network computing system.

[0106] Example 19. A computer-implemented method according to Example 13, wherein at least one of the thresholds of operational functions performed when processing the SACK message changes dynamically based on the occurrence of a specified trigger.

[0107] Example 20. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to: apply one or more transport protocol heuristic algorithms to a selective acknowledgment (SACK) message received by a network adapter from a network node, the transport protocol heuristic algorithms identifying one or more thresholds of operational functions performed when processing the SACK messages; determine that one or more thresholds of the transport protocol heuristic algorithms have been reached by applying the one or more transport protocol heuristic algorithms to the SACK messages received from the network node; and in response to determining that one or more of the thresholds have been reached: identify the network node as a security threat; and take one or more remedial actions to mitigate the security threat.

[0108] As mentioned above, the computing devices and systems described and / or illustrated herein broadly represent any type or form of computing device or system capable of executing computer-readable instructions, such as those contained in the modules described herein. In their most basic configuration, these computing devices may each include at least one memory device and at least one physical processor.

[0109] In some examples, the term "memory device" generally refers to any type or form of volatile or non-volatile storage device or medium capable of storing data and / or computer-readable instructions. In one example, a memory device can store, load, and / or maintain one or more of the modules described herein. Examples of memory devices include, but are not limited to, random access memory (RAM), read-only memory (ROM), flash memory, hard disk drive (HDD), solid-state drive (SSD), optical drive, cache, variations or combinations of one or more thereof, or any other suitable storage memory.

[0110] In some examples, the term "physical processor" generally refers to any type or form of hardware-implemented processing unit capable of interpreting and / or executing computer-readable instructions. In one example, a physical processor can access and / or modify one or more modules stored in the above-mentioned memory device. Examples of physical processors include, but are not limited to, a microprocessor, a microcontroller, a central processing unit (CPU), a field programmable gate array (FPGA) implementing a soft-core processor, an application-specific integrated circuit (ASIC), a portion of one or more thereof, a variation or combination of one or more thereof, or any other suitable physical processor.

[0111] Although illustrated as separate elements, the modules described and / or shown herein may represent portions of a single module or application. In addition, in some embodiments, one or more of these modules may represent one or more software applications or programs that, when executed by a computing device, may cause the computing device to perform one or more tasks. For example, one or more of the modules described and / or shown herein may represent modules stored and configured to run on one or more of the computing devices or systems described and / or shown herein. One or more of these modules may also represent all or part of one or more special-purpose computers configured to perform one or more tasks.

[0112] In addition, one or more of the modules described herein can convert data, physical devices, and / or representations of physical devices from one form to another. For example, one or more of the modules described herein can receive data to be converted, convert the data, output the conversion results to apply a heuristic algorithm, use the conversion results to identify security threats, and store the conversion results to identify future security threats. Additionally or alternatively, one or more of the modules described herein can convert a processor, volatile memory, non-volatile memory, and / or any other part of a physical computing device from one form to another by executing on a computing device, storing data on a computing device, and / or otherwise interacting with a computing device.

[0113] In some embodiments, the term "computer-readable medium" refers generally to any form of device, carrier, or medium that can store or carry computer-readable instructions. Examples of computer-readable media include, but are not limited to, transmission media (such as carrier waves) and non-transitory media (such as magnetic storage media (e.g., hard drives, tape drives, and floppy disks), optical storage media (e.g., compact disks (CDs), digital video disks (DVDs), and Blu-ray disks), electronic storage media (e.g., solid-state drives and flash memory media), and other distribution systems.

[0114] The process parameters and order of the steps described and / or shown herein are given by way of example only and may be changed as desired. For example, although the steps shown and / or described herein may be shown or discussed in a particular order, these steps do not necessarily need to be performed in the order shown or discussed. The various exemplary methods described and / or shown herein may also omit one or more of the steps described or shown herein, or include additional steps in addition to those steps disclosed.

[0115] The above description is provided to enable other persons skilled in the art to best utilize the various aspects of the exemplary embodiments disclosed herein. This exemplary description is not intended to be exhaustive or limited to any precise form disclosed. Many modifications and variations may be made without departing from the spirit and scope of the present invention. The embodiments disclosed herein should be considered in all respects to be illustrative and not restrictive. In determining the scope of the present invention, reference should be made to the appended claims and their equivalents.

[0116] Unless otherwise indicated, the words "connected to" and "coupled to" (and their derivatives) used in the specification and claims should be interpreted as allowing both direct and indirect (i.e., through other elements or components) connections. In addition, the words "a" or "an" used in the specification and claims should be interpreted as meaning "at least one". Finally, for ease of use, the words "including" and "having" (and their derivatives) used in the specification and claims are interchangeable with the word "comprising" and have the same meaning as the word "comprising".

Claims

1. A network computing system, comprising: Network adapters, which send and receive data via transport protocols; a memory device to at least temporarily store data received at the network adapter; A processor, processing at least part of the received data, comprising: applying one or more transport protocol heuristic algorithms to a selective acknowledgement (SACK) message received at the network adapter from a network node, the transport protocol heuristic algorithms identifying one or more thresholds for operational functions performed when processing the SACK message; determining that a threshold of one or more of the transport protocol heuristics has been reached by applying the one or more transport protocol heuristics to a SACK message received from the network node, wherein determining that the threshold of one or more of the transport protocol heuristics has been reached comprises: determining that the network node is attempting to acknowledge a number of transmission attempts for increasing the size of a transmission map; and In response to determining that one or more of the thresholds have been reached, performing the following operations: identifying the network node as a security threat; and One or more remedial actions are taken to mitigate the security threat associated with the identified network node.

2. The network computing system according to claim 1, wherein: Applying the one or more transport protocol heuristic algorithms to the SACK message includes incrementing one or more counters associated with the operational function while processing the SACK message.

3. The network computing system according to claim 2, wherein: The counter indicates when a threshold for one or more of the transport protocol heuristics is reached.

4. The network computing system according to claim 2, wherein: One or more of the counters are modified upon receipt of an acknowledgement ACK message.

5. The network computing system according to claim 1, wherein: The security threat includes an attacking node that attacks the network computing system.

6. The network computing system according to claim 1, wherein: At least one of the one or more remedial measures for mitigating the security threat includes ignoring at least some of the SACK messages received from the network node.

7. The network computing system according to claim 1, wherein: At least one of the thresholds for operational functions performed when processing the SACK message includes an indication of whether the ACK position is to be moved within the send map.

8. The network computing system according to claim 7, wherein: At least one of the thresholds for operational functions performed when processing the SACK message includes a measurement of a distance the ACK location is to move within the transmission map.

9. The network computing system according to claim 1, wherein: At least one of the thresholds for operational functions performed when processing the SACK message includes an indication of how many SACK messages are received within a specified time period.

10. The network computing system of claim 1, further comprising filtering the SACK messages to remove previously received SACK messages.

11. The network computing system according to claim 10, wherein: Filtering the SACK messages also includes removing duplicate SACK messages.

12. The network computing system according to claim 10, wherein: At least one of the thresholds for operational functions performed when processing the SACK message includes an indication of how many SACK messages were filtered within a specified time period.

13. A computer-implemented method comprising: applying one or more transport protocol heuristic algorithms to a selective acknowledgement (SACK) message received at a network adapter from a network node, the transport protocol heuristic algorithms identifying one or more thresholds for operational functions performed when processing the SACK message; determining that a threshold of one or more of the transport protocol heuristics has been reached by applying the one or more transport protocol heuristics to a SACK message received from the network node, wherein determining that the threshold of one or more of the transport protocol heuristics has been reached comprises: determining that the network node is attempting to acknowledge a number of transmission attempts for increasing the size of a transmission map; and In response to determining that one or more of the thresholds have been reached, performing the following operations: identifying the network node as a security threat; and One or more remedial actions are taken to mitigate the security threat associated with the identified network node.

14. The computer-implemented method of claim 13, further comprising adding a decay factor to the transmit map to decrement one or more counters associated with an ACK or SACK message.

15. The computer-implemented method of claim 14, wherein: When the ACK or SACK message is removed, the network node is identified as a security threat.

16. The computer-implemented method of claim 15, wherein: Upon determining that the network node no longer meets the threshold, the network node is subsequently removed from the category of being classified as a security threat.

17. The computer-implemented method of claim 13, wherein: At least one of the thresholds of the operational functions performed when processing the SACK message is dynamically changed based on one or more current operating conditions of the network computing system.

18. The computer-implemented method of claim 13, wherein: At least one of the thresholds of the operational functions performed when processing the SACK message is dynamically changed based on the occurrence of a specified trigger.

19. A non-transitory computer-readable medium comprising one or more computer-readable instructions, which, when executed by at least one processor of a computing device, cause the computing device to perform the following operations: applying one or more transport protocol heuristic algorithms to a selective acknowledgement (SACK) message received at a network adapter from a network node, the transport protocol heuristic algorithms identifying one or more thresholds for operational functions to be performed when processing the SACK message; determining that a threshold of one or more of the transport protocol heuristic algorithms has been reached by applying the one or more transport protocol heuristic algorithms to a SACK message received from the network node, wherein, Determining that a threshold for one or more of the transmission protocol heuristics has been reached includes: determining that the network node is attempting to confirm that there are a number of transmission attempts for increasing the size of a transmission map; as well as In response to determining that one or more of the thresholds have been reached, performing the following operations: identifying the network node as a security threat; and One or more remedial actions are taken to mitigate the security threat associated with the identified network node.

Images