The patent badge is an abbreviated version of the USPTO patent document. The patent badge does contain a link to the full patent document.

The patent badge is an abbreviated version of the USPTO patent document. The patent badge covers the following: Patent number, Date patent was issued, Date patent was filed, Title of the patent, Applicant, Inventor, Assignee, Attorney firm, Primary examiner, Assistant examiner, CPCs, and Abstract. The patent badge does contain a link to the full patent document (in Adobe Acrobat format, aka pdf). To download or print any patent click here.

Date of Patent:
Apr. 25, 2017

Filed:

Apr. 01, 2013
Applicant:

International Business Machines Corporation, Armonk, NY (US);

Inventors:

Robert W. Danford, Raleigh, NC (US);

Terry D. Escamilla, Lafayette, CO (US);

Kevin D. Himberger, Durham, NC (US);

Clark D. Jeffries, Chapel Hill, NC (US);

Attorneys:
Primary Examiner:
Assistant Examiner:
Int. Cl.
CPC ...
G06F 15/173 (2006.01); G06F 21/55 (2013.01); H04L 29/06 (2006.01); G06F 11/34 (2006.01);
U.S. Cl.
CPC ...
G06F 21/55 (2013.01); H04L 63/1416 (2013.01); H04L 63/1458 (2013.01); G06F 11/349 (2013.01); G06F 11/3495 (2013.01); G06F 2201/81 (2013.01); H04L 2463/141 (2013.01); H04L 2463/144 (2013.01); Y02B 60/165 (2013.01);
Abstract

A method, system, and/or computer program product manages a distributed denial of service attack in a multiprocessor environment. A determination is made of (a) a first upper threshold for a normal number of packets from the multiprocessor environment to multiple destination addresses, (b) a second upper threshold for a normal ratio of the packets from the multiprocessor environment to a single destination address compared to the packets from the multiprocessor environment to the multiple destination addresses, and (c) a third upper threshold for a normal ratio of packets from the multiprocessor environment to a single port at a single destination address compared to packets from the multiprocessor environment to the multiple destination addresses. In response to the first and second thresholds being exceeded, a specific port is monitored to determine if the third upper threshold is being exceeded at that port, thus indicating an apparent distributed denial of service attack.


Find Patent Forward Citations

Loading…