Attack traffic signature generation using statistical pattern recognition
US-8997227-B1 · Mar 31, 2015 · US
US11516098B2 · US · B2
| Field | Value |
|---|---|
| Publication number | US-11516098-B2 |
| Application number | US-202117238193-A |
| Country | US |
| Kind code | B2 |
| Filing date | Apr 22, 2021 |
| Priority date | Jun 5, 2015 |
| Publication date | Nov 29, 2022 |
| Grant date | Nov 29, 2022 |
A practical reading order for non-experts. Skip the full description unless you need deep technical detail.
What the patent document calls the invention.
A short plain-language summary of the technical disclosure.
Who owns or filed the patent and who is credited as inventor.
Filing, priority, publication, and grant dates set the timeline.
The legal scope of protection — read this for what is actually claimed.
Technology tags used to group this patent with similar filings.
Prior art links and similar publications in this corpus.
Official abstract text for this publication.
Systems, methods, and computer-readable media are provided for determining a packet's round trip time (RTT) in a network. A system can receive information of a packet sent by a component of the network and further determine an expected acknowledgement (ACK) sequence number associated with the packet based upon received information of the packet. The system can receive information of a subsequent packet received by the component and determine an ACK sequence number and a receiving time of the subsequent packet. In response to determining that the ACK sequence number of the subsequent TCP packet matches the expected ACK sequence number, the system can determine a round trip time (RTT) of the packet based upon the received information of the packet and the received information of the subsequent packet.
Opening claim text (preview).
What is claimed is: 1. A method comprising: determining an expected acknowledgement (ACK) sequence number associated with a packet sent by a device in a network; determining an ACK sequence number of a different packet received by the device; determining that the ACK sequence number of the different packet does not match the expected ACK sequence number; and ignoring the different packet when the ACK sequence number of the different packet does not match the expected ACK sequence number. 2. The method of claim 1 , further comprising: generating a warning when the ACK sequence number of the different packet does not match the expected ACK sequence number, the warning being separate from the packet and the different packet. 3. The method of claim 1 , further comprising: determining an additional expected ACK sequence number associated with an additional packet sent by the device; determining that an additional ACK sequence number of a different additional packet received by the device matches the additional expected ACK sequence number associated with the additional packet; and determining a round trip time (RTT) of the additional packet based on first information of the additional packet and second information of the different packet. 4. The method of claim 3 , further comprising: receiving third information corresponding to a transmission control protocol (TCP) handshake performed within a specific time period and associated with a TCP connection; and based on the third information corresponding to the TCP handshake, determining a number of at least one of re-transmission packets and new packets transmitted during the specific time period. 5. The method of claim 1 , wherein the expected ACK sequence number is determined based on a third ACK sequence number of the packet and a size of the packet. 6. The method of claim 1 , further comprising: determining a sending time, a packet sequence number and a packet size of the packet based on packet information sensed by at least one sensor of a plurality of sensors in the network, the packet information corresponding to the packet. 7. The method of claim 6 , further comprising: determining a receive time of a subsequent packet received by the device; and determining a round trip time (RTT) of the packet based on the sending time of the packet and the receive time of the subsequent packet. 8. The method of claim 1 , further comprising: determine a respective ACK sequence number of a following packet based on first packet information of the following packet; and in response to a determination that the respective ACK sequence number of the following packet matches a second expected ACK sequence number, determining a round trip time (RTT) of the packet based on second packet information of the packet and the first packet information of the following packet. 9. The method of claim 1 , further comprising: determining a congestion level of the network based at least on a round trip time (RTT) of the packet. 10. The method of claim 1 , further comprising: determining a number of non-duplicative packets; and determining a packet loss rate of the network during a time period based at least on the number of non-duplicative packets. 11. A system comprising: one or more processors; and a computer-readable storage medium storing instructions which, when executed by the one or more processors, cause the system to: determine an expected acknowledgement (ACK) sequence number associated with a packet sent by a component in a network; determine an ACK sequence number of a different packet received by the component; determine that the ACK sequence number of the different packet does not match the expected ACK sequence number; and ignore the different packet when the ACK sequence number of the different packet does not match the expected ACK sequence number. 12. The system of claim 11 , wherein the instructions, when executed by the one or more processors, cause the system to: select a range of packet sequence numbers; determine a packet sequence number of the packet based on packet information of the packet; and determine that the packet sequence number of the packet is within the range of packet sequence numbers. 13. The system of claim 11 , wherein the instructions, when executed by the one or more processors, cause the system to: generate a warning when the ACK sequence number of the different packet does not match the expected ACK sequence number, the warning being separate from the packet and the different packet. 14. The system of claim 11 , wherein the instructions, when executed by the one or more processors, cause the system to: determine an additional expected ACK sequence number associated with an additional packet sent by the component; determine that an additional ACK sequence number of a different additional packet received by the component matches the additional expected ACK sequence number associated with the additional packet; and determine a round trip time (RTT) of the additional packet based on first information of the additional packet and second information of the different additional packet. 15. The system of claim 14 , wherein the instructions, when executed by the one or more processors, cause the system to: receive third information corresponding to a transmission control protocol (TCP) handshake performed within a specific time period and associated with a TCP connection; and based on the third information corresponding to the TCP handshake, determine a number of at least one of re-transmission packets and new packets transmitted during the specific time period. 16. The system of claim 11 , wherein the expected ACK sequence number is determined based on an additional ACK sequence number of the packet and a size of the packet. 17. The system of claim 11 , wherein the instructions, when executed by the one or more processors, cause the system to: determine a sending time, a packet sequence number and a packet size of the packet based on packet information sensed by at least one sensor of a plurality of sensors in the network, the packet information corresponding to the packet; determine a receive time of a further packet received by the component; and determine a round trip time (RTT) of the packet based on the sending time of the packet and the receive time of the further packet. 18. The system of claim 11 , wherein the instructions, when executed by the one or more processors, cause the system to: determine a number of non-duplicative packets; and determine a packet loss rate of the network during a time period based at least on the number of non-duplicative packets. 19. The system of claim 11 , wherein the expected ACK sequence number is determined independent of the different packet. 20. A non-transitory computer-readable medium having stored thereon instructions which, when executed by one or more processors, cause the one or more processors to: determine an expected acknowledgement (ACK) sequence number associated with a packet sent by a component in a network; determine an ACK sequence number of a different packet received by the component; determine that the ACK sequence number of the different packet does not match the expected ACK sequence number; and ignore the different packet when the ACK sequence number of the different packet does not match the expected ACK sequence number.
Drawing of charts or graphs · CPC title
based on quality criteria · CPC title
Policy-based network configuration management · CPC title
De-duplication implemented within the file system, e.g. based on file segments (de-duplication techniques in storage systems for the management of data blocks G06F3/0641) · CPC title
using compression, e.g. sparse files · CPC title
Related publications grouped by family.
Answers are generated from the same data shown on this page.