RU2179738C2 - Method for detecting remote attacks in computer network - Google Patents

Abstract

FIELD: computer engineering. SUBSTANCE: method used for networks where communications among subscribers are effected by transmitting data bursts in compliance with TCP protocol includes watching traffic of data bursts arriving at subscriber, checking these data bursts according to specified rules, and sending signal to take measures for protection against unauthorized access when check reveals adherence to mentioned rules. In order to detect attempts of unauthorized access made on behalf of fraudulently assigned name of other subscriber of network traffic of data bursts addressed to subscriber is watched including permanently resumed counting of burst number executed within series of bursts arriving one after other in time intervals exceeding those specified; arriving data bursts are checked for compliance with specified rules each time when size of arriving series under check rises to critical number of bursts. EFFECT: facilitated procedure. 4 cl, 4 dwg

Description

 The invention relates to the field of protection against unauthorized access to the resources of a computer system, and in particular to methods and devices for detecting remote attacks on subscribers of computer networks carried out by means of network connections, in particular, in global computer networks, and protection against such actions.

 The present description assumes a general familiarity with the concepts, protocols, and devices used in computer networking applications.

 There are a significant number of methods and devices for protecting information in computing systems for various purposes, based on restricting access to information of various levels of confidentiality: using passwords when entering the system, blocking certain memory areas, using cryptographic protection tools, suppressing spurious electromagnetic radiation from computing devices and channels information transfer.

 Known attacks based on password selection, a description of how to detect such attacks and ways to protect against them is given in the book [5. David Steng, Sylvia Moon, "Secrets of Network Security", Kiev, "Dialectics", 1996].

 Network systems are characterized by the fact that, along with conventional, local attacks carried out within the same computer system, a specific type of attack is applicable to them, due to the distribution of resources and information in space. These are the so-called network or remote attacks. By remote attack on a computer system here is meant the information destructive effect on a distributed computing system (RVS), programmatically carried out through communication channels by one or a group of people who have malicious intent. However, it is often impossible to distinguish between deliberate and random actions, and a good defense system must adequately respond to any of them.

 Insufficient security of the most common RVS operating systems and communication protocols makes it possible to carry out various types of remote attacks on RVS, which differ in implementation mechanisms, nature and purpose of the impact. The preliminary stage of remote attacks is usually the analysis of network traffic, that is, the flow of information exchange, which allows you to study the logic of the distributed computing system. Obtaining information about the RVS is achieved by an attacker by intercepting and analyzing the transmitted data. The possibility of interception of data exists due to the fact that the components of any network system are distributed in space and communication between them is physically carried out using network connections for which a coaxial cable, twisted pair cable, optical fiber, etc. are used.

 Remote attacks are carried out programmatically using message mechanisms. Known varieties of remote attacks and methods of protection against them are described, for example, in the book: I. Medvedovsky, P. Semenov, V. Platonov "Attack through the Internet", St. Petersburg, NGO "Peace and Family - 95", 1997.

 A remote attack causing a denial of service allows disrupting the operability of the corresponding remote access service or telecommunication service at the attacked site, i.e. make it impossible to obtain remote access from other objects. Denial of service is achieved by transmitting to the attacked subscriber the largest possible number of connection requests on behalf of other subscribers, or by transmitting from one address as many requests as traffic allows.

 A dangerous variety of remote attacks is the substitution of a computer network subscriber, which is based on the transmission of messages from a fraudulently assigned name of an arbitrary subscriber to this network. Substitution of a computer network subscriber can provide unauthorized access to the resources of the attacked subscriber if the replaced subscriber is a trusted interaction object for the attacked. An attack by substituting a computer network subscriber can be carried out both during a network connection session between the attacked and the replaced subscriber, and by sending a request to the attacked subscriber to establish a connection on behalf of the replaced subscriber. The peculiarity of such an attack is that the attacker has only one-way communication with the attacked, since the answers of the attacked are addressed to the fake subscriber. Since the intervention of the substitute subscriber can interfere with the achievement of the objectives of the attack, substitution of the subscriber of the computer network is usually combined with the simultaneous conduct of an attack causing a denial of service of the substitute subscriber.

 The present invention provides a method for detecting remote attacks based on the substitution of a computer network subscriber.

 Closest to the proposed invention is described in patent US 5796942 regarding network surveillance systems.

This system, designed to monitor a computer network independently of a network server, contains:
a network driver for collecting data on a network that is not necessarily addressed to a network surveillance system;
a control process for receiving data from a network driver and storing said data in real time;
many recording files for receiving and storing data before further processing;
a scanning process for which one of said plurality of recording files is designated as a receiving file for reading data of other files from the plurality of recording files and for using said data to recreate a plurality of data streams in network connection sessions, said data streams in network connections providing sequential reconstruction of network data traffic in a network connection session;
a session scanner for reading data in the interval of one of the specified set of network connection sessions;
a set of rules for identifying data stereotypes that, when detected, will trigger an alarm;
means for a specific response in the event of the identification of data that meets the given rules.

 The system for monitoring a computer network, characterized by the above patent claims US Pat. their side. Such a system requires a high-performance computing complex with several processors operating at frequencies of 233 - 500 MHz for its implementation. In order to detect attempts of unauthorized access to the resources of subscribers of a computer network, the system provides reconstruction of data streams transmitted in sessions of network connections, and sequential reading of data transmitted in various sessions, and checks in accordance with a set of rules performed to detect attempts of unauthorized access to resources of subscribers directly transmitted data itself. Although this system provides real-time data collection, however, when sequentially analyzing multiple network connection sessions, the detection of unauthorized actions in a controlled computer network is inevitable late with respect to the beginning of such actions. In many cases, being late in taking measures to prevent unauthorized actions can lead to irreparable damage and render protection ineffective.

 The present invention is based on the task of creating a simple method that minimally detects real-time attempts to unauthorized access to the resources of a computer network subscriber, in particular the Internet, carried out by means of remote connection and based on actions from a fraudulently assigned name of another subscriber of this computer network.

 The problem is solved in that in the method for detecting attempts of unauthorized access to the resources of a computer network subscriber, carried out by means of a remote network connection, in which the traffic of data packets arriving to the subscriber is monitored, they are checked according to the given rules and give a signal for taking measures of protection against unauthorized access when the check reveals compliance with the specified rules, according to the invention for detecting attempts of unauthorized access to resources that computer network in which communication between subscribers is carried out by transmitting data packets in accordance with the TCP protocol produced from a fraudulently assigned name of another subscriber to the specified network, monitor the traffic of data packets addressed to the subscriber, including constantly renewed counting of the number of packets performed within a series of packets arriving successively one after another at intervals of no more than a given, while checking the incoming data packets for compliance with the specified rules yayut every time when the size of the next series of observed packet reaches the critical number of packets.

 The method is intended to provide protection for the subscriber by warning of an attempted attack by substituting a subscriber for a computer network and is based on an analysis of the necessary conditions for establishing a false connection on behalf of a substitute subscriber, mainly on the Internet.

 In order for the false message packets sent by the attacking attacked subscriber to be interpreted by the latter as sent by the fake subscriber, it is necessary that these packets have certain values of their identification parameters used in the TCP communication protocol. These values can be known to the attacker only with some approximation, depending on the type of operating system of the attacked subscriber and the number of nodes of the computer network through which data packets sent by the attacker reach the attacked subscriber. Therefore, to select the identification parameters, the attacker is forced to send a series of packets with different values of the identification parameters instead of one packet to the attacker.

 A series of packets following with small intervals of time are potentially dangerous for the protected subscriber of the computer network, since the probability of successful selection of identification parameters decreases with an increase in the time spent on selecting. In this regard, the proposed method includes constant monitoring of the size of the series of packets arriving at short intervals.

 The critical series size, starting from which such a series of packets can ensure the successful selection of false packet identification parameters, can be set based on the results of an attack simulation that uses the substitution of at least one of its trusted interaction objects.

 The maximum value of the time interval between adjacent packets belonging to the same series, it is preferable to set at least the time that the subscriber needs for the initial processing of the received packet.

 Receiving a series whose size reaches a critical number of packets serves as a signal to begin checking incoming packets. Such a check includes, for example, the formation of a signal for taking measures to protect against unauthorized access, when, within a given time interval, from reaching one series of a size of at least a critical number of packets, a second series is detected, the size of which also reaches a critical one.

 It is advisable to monitor the traffic of data packets addressed to the subscriber, including continuously renewed counting of the number of packets, performed within a series of packets arriving successively after each other at intervals of no more than a specified one, using a specialized computing device that exchanges signals with the specified subscriber.

 A hardware implementation of monitoring the size of a series of packets ensures minimal diversion of the protected computer's resources to detect attacks.

The proposed invention is further discussed on the example of its preferred implementation in relation to the Internet, with reference to the drawings, in which:
FIG. 1 shows a diagram of an attack carried out by changing a subscriber of a computer network.

 FIG. 2 depicts a block diagram of a device that monitors the size of a series of data packets arriving to a protected subscriber when implementing a method for detecting remote attacks in a computer network according to the present invention.

 FIG. 3 depicts a flowchart of an algorithm for verifying data packets arriving to a protected subscriber that is performed by implementing a method for detecting remote attacks in a computer network according to the present invention, if surveillance is performed using the device depicted in FIG. 2, revealed a series having a size of at least a given number of packets.

 FIG. 4 is a timing diagram of the operation of the device of FIG. 2, and actions when executing the algorithm depicted in FIG. 3.

 On the Internet, the basic transport layer protocol is TCP. In accordance with the TCP protocol, information on a computer network is transmitted in the form of packets of a fixed value. The TCP protocol allows you to correct errors that may occur during the transmission of packets, and is a protocol with the establishment of a logical connection - a virtual channel. Packets are transmitted and received on this channel with registration of their sequence, packet flow is controlled, retransmission of distorted packets is organized, and at the end of the session the channel is broken. At the same time, TCP is a protocol that has an additional message identification and connection system. Application layer protocols that provide users with remote access to other Internet subscribers are implemented on the basis of the TCP protocol.

 A TCP packet has a header that contains two packet identification parameters, which are 32-bit binary numbers. The values of the first and second identification parameters of the packet perform the function of the current numbers assigned to this packet, respectively, by its sender and recipient. A pair of current packet numbers indicates the location of a given packet in the sequence of packets transmitted in a connection session. In addition, the TCP header contains commands for the subscriber to whom the packet is intended, as well as its address.

 Establishing a TCP connection between two Internet subscribers, if the initiative belongs to the first of them, is carried out in the following order.

 The first subscriber sends a packet to the address of the second subscriber, the header of which contains the value of the first identification parameter, which is the initial number specified by the first subscriber in the sequence of the current packet numbers of this connection session.

 The second subscriber responds with the first sending of the second session packet, the header of which contains the value of the first identification parameter, which is the initial number assigned to this packet by the second subscriber, and the value of the second is equal to the unit value of the initial number contained in the first session packet received from the first subscriber.

 Establishment of the connection ends with the sending by the first subscriber to the second of another packet containing the values of both starting numbers of the second session packet increased by one.

 From the moment the connection is established, the first subscriber can send packets containing data to the second subscriber. Each packet arriving to the participant during the connection session will be interpreted by him as the next packet of this session if this packet has current numbers that are one higher than the current numbers of the previous packet, otherwise the received packet will be discarded as erroneous.

 The reason for the vulnerability for attacks based on the substitution of a subscriber is the imperfection of the principles of forming the initial numbers of session packets embedded in the most common operating systems (OS) used by Internet subscribers. Most operating systems use a time-dependent algorithm for generating the initial packet number of a TCP connection. For example, in Windows NT 4.0, this value increases by approximately 10 every millisecond.

 This allows the attacker to approximately determine the type of function according to which the initial value of the packet identifier is generated. To investigate the OS of a subscriber of the Internet, an attacker who is also a subscriber of this network needs to send a specified subscriber a sequence of ordinary requests to create a TCP connection and receive the corresponding number of response packets having the start numbers assigned to the OS under study at each time point. At the same time, the time intervals between the request and the response to it and the time elapsed between requests are measured. As it is clear to a specialist in numerical mathematical methods, as a result of such a study, an empirical time dependence of the initial number generated by the OS under study can be constructed, which allows predicting its value in the form of an interval estimate. For example, if an attacker is in the same network segment with the selected attack target as a subscriber, this technique allows for a short period of time to extrapolate the initial number for Windows NT - with an accuracy of 10, and for Linux 1.2.8 - with an accuracy of about 100 .

 Thus, a preliminary study of the OS of the Internet subscriber provides a real opportunity to select the current package numbers for replacing the subscriber of the computer network.

 Significant danger due to the best conditions for an attack is the substitution of a trusted subscriber with a simplified access mode without password verification, which is used in some common operating systems, for example, in UNIX OS.

 The attack scheme based on the substitution of a subscriber is illustrated in FIG. 1.

 In FIG. 1 shows a fake subscriber 1, subscriber 2, which is the object of attack, and an attacking attacker 3.

 Attacker 3 sends to subscriber 2 a packet containing a request to establish a connection on behalf of the fake subscriber 1. This packet containing the starting number N03, which is assigned by attacker 3, after a while reaches subscriber 1. Subscriber 2, in accordance with the procedure for establishing a TCP connection , responds to the received request packet with a confirmation packet containing the first current number equal to the initial number specified by subscriber 2, N2 = N02, and the second current number equal to one increased by the initial number from the request packet a, N3 = N03 + 1.

 A significant feature of the attack based on the substitution of the subscriber is that the attacker 3 does not receive responses from the attacked subscriber 2, since all packets sent by the attacked subscriber 2 in response to the false packets of the attacker 3 are addressed to the substitute subscriber 1. Intervention of subscriber 1 in response to confirm the connection, which subscriber 1 did not request, will prevent the continuation of the attack. Therefore, in this attack scheme, attacker 3 needs to simultaneously attack subscriber 1, for example, with a series of requests to establish a connection in order to create a denial of service for him during the attack.

 To complete the establishment of a false connection, the attacker 3 must send to the subscriber 2 a packet that has the correct values of both current numbers. One of these numbers, N3, is known to attacker 3, since it is formed from the initial number of the request packet specified by himself. The attacker 3 from the preliminary investigation may also know the interval within which, with a given probability, is the value of the initial number N02. However, the attacker 3 can only be guided by the evaluation of the starting number N02, since the moment subscriber 2 receives a false request packet from him and, accordingly, the moment subscriber 2 assigns the starting number N02 to the confirmation packet, depend on the delay in sending the packet over the Internet. This delay can randomly vary from a few milliseconds to one second depending on the loading of a network section between attacker 3 and subscriber 2 at the time of sending the request packet. Therefore, attacker 3, in order to complete the establishment of a false connection, is forced to send to the attacked subscriber 2 a series of packets instead of one packet, which enumerates the values of the initial number N02 in the interval defined by the attacker 3. The size of the time intervals for packets in the series determines the total duration of the series, and since the extrapolation error of the initial number N02 is proportional to the extrapolation interval, the longer the time intervals for packets in the series, the larger the size of the series.

 The calculations performed by the authors show that the probability of a successful attack decreases with an increase in the time intervals for packets to follow in a series, therefore sending a series with minimal time intervals between packets is an advantageous strategy for an attacker.

 The second series of packets, each of which may contain commands for gaining further access to the resources of subscriber 2, must be sent by attacker 3 with an interval of time in relation to the previous series, chosen so that with high probability, in case of an accidental delay in transmission over the network, the packet the second series with the correct value of the current number N2 = N02 + 1 reached subscriber 2 after receiving a packet with the starting number N02 from the first series of packets, since otherwise the attack will fail. This means that on the subscriber side 2, successive series of packets, as a rule, should not overlap, that is, separated by an interval exceeding the time intervals between series packets.

 An attack is also possible during a connection between two Internet subscribers by trying to replace one of the participants in the connection. In this case, even if the connection between the subscribers is established using a password, the attacker does not need to know the password, because after the connection is established, the password is no longer used by the participants in the connection.

 An attack during a connection session between subscribers 1 and 2 can be carried out in the same way as in the case of the establishment of a false connection described above, and also requires the creation of a denial of service for the fake subscriber 1. The main difference is that an attack during a connection session requires the selection of both current numbers, respectively, N1 and N2, for a false packet. At the same time, the size of the series of the sent packets increases in the square with respect to the size of the series required when establishing a false connection. That is, the greatest danger is an attempt to establish a false connection on behalf of another subscriber, since this requires a minimum packet series size, which in the most favorable conditions for an attacker can not exceed several tens.

 Thus, an attack on a subscriber of a computer network is in any case characterized by the arrival of at least two series of packets in this subscriber, in which packets follow at short intervals.

 According to the present invention, the method for detecting attempts of unauthorized access to the resources of a computer network subscriber includes two phases: the first is the constant monitoring of the size of the series of TCP packets arriving to the protected subscriber, in which the packets follow at intervals of no more than a specified one, and the second is a further check for acceptance decide whether an attack occurs if an observation reveals a series of packets that are larger than a given number of packets.

 If the personal computer acts as the protected subscriber, the present invention can be implemented fully in software, that is, with the help of these devices equipped with the appropriate computing program that will be executed by the central processors of such devices. However, the preferred variant is the hardware implementation of monitoring the size of the series of packets and the software implementation of the verification phase, which, on the one hand, provides minimal diversion of resources of the protected computer to detect attacks, and on the other hand, allows maximum flexibility in the use of various scan options.

 In FIG. 2 is a block diagram of a device 4 that implements packet size monitoring according to the present invention. The device 4 is shown in interaction with the protected computer, the subscriber 2, through the interface 5, the device of which, for example, when connected to a common computer bus, is obvious to a person skilled in the art and does not have any features related to the present invention.

 From subscriber 2 to the device 4 through the interface 5, digital codes of natural numbers t0, a given maximum value of the time interval between adjacent packets belonging to the same series, and k0, a given critical size of the series of packets, indicated by positions 6 and 7, respectively, are received; pulses of the clock frequency of the internal generator of the subscriber 2 - position 8; packet pulses corresponding to the moment of completion of the initial processing of TCP packets arriving to subscriber 2 - position 9; the logical signal of the installation of the device 4 in the initial state is position 10.

 Logical variables are transferred back to device 2 to subscriber 2: position 11 denotes the variable S, which has the value TRUE from the moment when the size of the observed series reaches the value k0 for the first time until the end of this series, and the value is FALSE outside this period of time; as well as the signal of the logical variable Flag, indicated by the position 12, having the value TRUE from the moment of the end of the first detected series of size not less than k0 to the receipt of the signal from the subscriber 2 to set the device 4 to its initial state, the variable Flag has the value FALSE outside this period of time.

 Pulses of the clock frequency from the output 8 of the interface 5 are fed to the counting input of the counter 13, which plays the role of a timer for measuring the time intervals of packets. The counter 13 is set to "0" by each pulse of the packet from the output 9 of the interface 5. Thus, the number tp at the time of the arrival of the next pulse of the packet is proportional to the time interval between this packet and the previous one. By the outputs of the discharges, the counter 13 is connected to the inputs of the code comparator 14, which acts as a device for comparing the time interval tp calculated by the counter 13 with the set value to, which is entered from the interface 5 into the memory register 15 connected to the comparator 14.

 Through the device 16, which implements the logical AND function, packet pulses arrive at the counting input of the packet counter 17. The counter 17 counts the number k of packets related to the current series until the tp value in the counter 13 reaches the value t0. When the condition "tp is equal to t0" from the output of the comparator 14 to the reset input of the counter 17 packets receives a logical signal setting to "0".

 It is preferable to set the maximum value t0 of the time interval between adjacent packets belonging to the same series equal to the time that the protected subscriber of the computer network needs for the initial processing of the received packet, for example, 3 ms. As a rule, the bandwidth of the network interface through which the subscriber is connected to the computer network has a margin that ensures the network interface works without overflowing during normal traffic of transmitted messages. The fact that the flow of incoming packets increases to a value exceeding the bandwidth of the network interface is used in this method as a preliminary indication of a possible attack.

 The counter 17 is connected by the outputs of the bits to the code comparator 18, in which the series k of the size k calculated by the counter 17 is compared with a given critical size k0, the value of which is entered from the interface 5 into the memory register 19 connected to the comparator 18.

 The logical signal at the output of the comparator 18 represents a logical variable S. The logical signal from the output of the comparator 18, applied to the inverting input of the device 16, stops the supply of packet pulses to the counter 17 when the condition "k is equal to k0" is fulfilled. Fixing the value of k in the counter 17 at the level k0 up to the end of the current series, if its size exceeds k0, eliminates the overflow of the counter 17 during prolonged overload of the network interface of subscriber 2.

 The signal from the output of the device 20, a logical "And", sets the trigger 21 to the state "1" when the conditions "tp is equal to t0" and "k is equal to k0". The output signal of trigger 21 is a logical variable Flag, containing information about receiving a series of TCP packets with a size of at least a given critical size k0. The reset of the trigger 21 is carried out by a signal from the subscriber 2 transmitted on the output 10 of the interface 5.

 Thus, with the help of device 4, traffic is continuously monitored for data packets addressed to the protected subscriber, during which detection of series of packets with a size of at least critical is achieved. The critical size k0 of the series can be chosen as the minimum value, starting from which such a series of packets is capable of ensuring a successful attack. For example, if the protected subscriber uses WINDOWS NT 4.0, the value of k0 can be set to 10. However, it is preferable to choose the value of k0 based on a compromise between the sensitivity of the method when detecting attacks and the level of false alarms, determined from the simulation of the substitution of at least one of the trusted objects of interaction of the protected subscriber.

 As indicated above, a software implementation of the verification algorithm is preferred.

 The phase of checking the incoming TCP packets to the protected subscriber for an attack is illustrated by the flowchart of FIG. 3.

 The algorithm begins with step 22 of checking the value of the logical variable S. This value can be polled at a time interval approximately equal to the duration of a series of size k0 without the risk of delaying the detection of an attack.

 If S is FALSE, the operation 23 checks the value of the logical variable Flag, if its value is FALSE, then the algorithm execution cycle ends.

If one of the variables S or Flag has the value TRUE, then operation 24 is performed to check the value of the auxiliary logical variable R, which is used to once execute operation 25 of storing the value of the moment Ts when the first series of packets reaches size k0; after operation 25, operation 26 assign the variable R to TRUE. When the operation 24 is repeated, when the variable R is TRUE, the operation 27 is performed in which the difference between the current time moment by which the second series of packets has reached the size k0 and the fixed moment T _s with the given maximum time interval tm is compared. This interval can be set equal to the maximum time set by the protected subscriber to wait for the continuation of the communication session, usually several tens of seconds, after which the connection is disconnected by the subscriber if the next packet does not arrive from the connection partner during this time. If the time interval between successively obtained series of critical size does not exceed the specified one, then the operation 28 is performed for assigning the logical variable Alarm to TRUE, which is an alarm signal for which protection against attack is taken.

If the condition of operation 27 is not satisfied, then the operation proceeds to operations 29, 30 of assigning to the variables R and Flag the value FALSE. The last operation 30 is carried out by transmitting a reset signal to the trigger 21 via interface 5 (Fig. 2)
In FIG. 4 shows an exemplary view of time diagrams of k, S, Flag, Alarm values during an attack.

 Perhaps the use of more complex verification algorithms. In particular, after the discovery of a series of packets having a size that is more critical, a further assessment of the size of this series and the use of various protection measures depending on the size of the series can be made. The audit may also include storage for a certain time of information about all facts of obtaining a series of critical size, including those that did not directly trigger an alarm, for taking additional protective measures for a certain period of time.

 In the example implementation of the present invention, the protected subscriber was a personal computer. However, this does not impose restrictions on the type of protected object, a subscriber of a computer network, such as, for example, a LAN server connected to the Internet or a peripheral device.

Claims (4)

 1. A method for detecting attempts of unauthorized remote access to the resources of a computer network subscriber, in which communication between subscribers is carried out by transmitting data packets in accordance with the TCP protocol, including monitoring the traffic of data packets arriving to the subscriber, checking these packets according to predetermined rules, and signaling for reception protection measures against unauthorized access, when the check reveals compliance with the specified rules, characterized in that to detect attempts of unauthorized access UPA, produced from a misleadingly assigned name of another network subscriber, monitors the traffic of data packets addressed to the subscriber, including continuously renewed counting of the number of packets performed within a series of packets arriving in succession one after another at intervals of no more than specified, while checking incoming packets data on compliance with the given rules is performed every time the size of the next observed series reaches a critical number of packets.  2. The method according to p. 1, characterized in that the maximum value of the time interval between adjacent packets belonging to the same series is set at least the time that the subscriber needs for the initial processing of the received packet.  3. The method according to p. 1, characterized in that the signal for taking measures to protect against unauthorized access is given when, within a predetermined time interval from the end of one series of data packets having a size of at least a critical number of packets, the size of the next observed series reaches critical.  4. The method according to claim 1, characterized in that monitoring the traffic of data packets addressed to the subscriber, including continuously renewed counting of the number of packets, performed within a series of packets arriving successively after each other at intervals no more than specified, is performed using this computing device exchanging signals with the specified subscriber.

Images