Handling distributed denial-of-service attacks based on connect requests

Abstract

A network device may receive, from an endpoint device, a first synchronize packet requesting establishment of a connection, and may receive, from the endpoint device, a connection request for connecting with a server device. The network device may provide, to the server device, a second synchronize packet requesting a connection with the server device, and may provide, to the endpoint device, a connection response indicating establishment of a session between the network device and the server device. The network device may receive, from the endpoint device, a secure sockets layer message or a non-secure sockets layer message, and may calculate a reputation score for the endpoint device based on whether the secure sockets layer message or the non-secure sockets layer message is received from the endpoint device.