Pepper Hamilton LLP
Identification of attack flows in a multi-tier network topology
Embodiments can provide a computer implemented method in a data processing system comprising a processor and a memory comprising instructions, which are executed by the processor to cause the processor to implement a system for network protection, the method comprising determining, by the analyzing unit, if an incoming connection comprising one or more packets has a false latency larger than a trigger latency; if the incoming connection latency is larger than the trigger latency, reporting, by the analyzing unit, the incoming connection as a suspicious connection; determining, by the analyzing unit, if an attack is currently in progress; and if the attack is in progress, injecting, by the analyzing unit, at least one of the one or more packets of the incoming connection or one or more packets of an outgoing connection with a false latency.
International Business Machines Corporation
H H
H04L H04L
inventional inventional
Chun-Shuo Cheng-ta Yin Chih-Hung
Lin Lee Lee Chou