intrusion detection (id) system which uses signature and squelch values to prevent bandwidth (flood) attacks on a server

摘要

A method of analyzing packets at a node (270) of a network (100 figure 2) by an intrusion prevention system (91) executed by the node (270), comprising reading (151) the packet by the intrusion prevention system (91), comparing (153) the packet with a machine-readable signature file (281A-281N figure 5), determining the packet has a packet signature that corresponds with the machine-readable signature file (281A-281N figure 5), and determining the machine-readable signature file (281A-281N figure 5) has an associated squelch comprising a squelch threshold and a squelch period is provided. A computer-readable medium having stored thereon a set of instructions to be executed, the set of instructions that, when executed by a processor (272), cause the processor (272) to perform a computer method of reading (151) a packet, comparing (153) the packet with a machine-readable signature file (281A-281N figure 5), determining the packet has a packet signature that corresponds with the machine-readable signature file (281A-281N figure 5), and determining the machine-readable signature file (281A-281N figure 5) has an associated squelch comprising a squelch threshold and a squelch period is provided.