US RE50,354 E1
Automatic detection of malicious packets in DDOS attacks using an encoding scheme
Steinthor Bjarnason, Fjerdingby (NO); Andrew Ralph Beard, Roanoke, VA (US); and David Turnbull, Stanmore (AU)
Assigned to Arbor Networks, Inc., Westford, MA (US)
Filed by Arbor Networks, Inc., Westford, MA (US)
Filed on Aug. 24, 2023, as Appl. No. 18/237,877.
Application 18/237,877 is a reissue of application No. 16/379,240, filed on Apr. 9, 2019, granted, now 11,153,334, issued on Oct. 19, 2021.
Int. Cl. G06F 11/00 (2006.01); H04L 9/40 (2022.01); H04L 29/06 (2006.01)
CPC H04L 63/1416 (2013.01) [H04L 63/1425 (2013.01); H04L 63/1458 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A method of detecting patterns in network traffic, the method comprising:
receiving a plurality of packets of network traffic, each packet having data associated with respective fields of a set of fields;
performing a frequency analysis per field of the plurality of packets as a function of frequency of an occurrence of same data in a corresponding field;
selecting top values which are values associated with each field of the set of fields that satisfy a criterion as having occurred most frequently in the plurality of packets as a function of a result of the frequency analysis;
assigning a bit encoding scheme that uses variable bit encoding to encode [ encoding ] each of the top values for each field that has a top value [ using a variable bit encoding scheme] ;
encoding into a single value each packet of the plurality of packets based on a bitfield representation that uses the [ variable bit ] encoding scheme for values associated with each field that has a top value;
storing each potential combination of fields of the set of fields being processed , with all bits set per field when the field is an active field and no bits set when the field is inactive;
performing a bitwise [ an ] operation on each encoded packet with the stored potential combinations;
sorting results of the bitwise operation based on a number of the active fields and a number of occurrences of each same result of the bitwise operation; and
providing the results of the sorting to a mitigation device for determining whether an attack is underway or for filtering network traffic for mitigating an attack [ based on the sorted results of the operation] .