Abstract: Techniques for measuring network performance using the inter-packet gap metric are described. According to one approach, a computer-implemented method comprises a plurality of inter-packet gap buckets, along with their associated counts and inter-packet gap value ranges, being created and stored at a network node. Two or more network packets are received at a network node as a part of at least one unidirectional flow. For each successively received packet, the network node then determines the inter-packet gap value. Next, the network node compares the inter-packet gap value with the different discrete inter-packet gap value ranges that are associated with the stored inter-packet gap buckets. If the inter-packet gap value is included in an inter-packet gap value range associated with a particular inter-packet gap bucket then the that bucket is updated. The network node then exports the inter-packet gap metric data to a computer system.

Abstract: A method is disclosed for distributed detection of botnets via a plurality of sensors on a network. According to embodiments, DNS information, including domain names and addresses, is received at a sensor, the number of unique subnets corresponding to a domain name is determined and an alert is sent to other sensors when the number of unique subnets exceeds a first threshold. Other embodiments are also disclosed.

Abstract: A method is disclosed for distributed detection of botnets via a plurality of sensors on a network. According to embodiments, DNS information, including domain names and addresses, is received at a sensor, the number of unique subnets corresponding to a domain name is determined and an alert is sent to other sensors when the number of unique subnets exceeds a first threshold. Other embodiments are also disclosed.

Abstract: A method, system and apparatus for preventing Denial of Service (DOS) attacks on a device are provided. The method includes determining that the device is receiving DOS attack vectors. The method further includes identifying the attack vector with the highest idle time and removing the identified attack vector. Further, the method includes repeating identifying and removing the identified attack vector until the number of attack vectors falls below a threshold value.

Abstract: A method, system and apparatus for preventing Denial of Service (DOS) attacks on a device are provided. The method includes determining that the device is receiving DOS attack vectors. The method further includes identifying the attack vector with the highest idle time and removing the identified attack vector. Further, the method includes repeating identifying and removing the identified attack vector until the number of attack vectors falls below a threshold value.

Abstract: A method, system and a computer program product for managing requests for Uniform Resource Locators (URLs) in a firewall is provided. The firewall scans for requests for URLs and extracts the URLs from the requests. The firewall then checks for the URLs in an exclusive domains list. If the exclusive domains list allows the requested URLs, the firewall allows the URLs. In case the exclusive domains list disallows the requested URLs, the firewall blocks the requests for the URLs.