Patent ID: 11962615
Assignee: BANK OF AMERICA CORPORATION
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 0:
1. A system for Denial-of-Service (DoS) attack detection comprising:
a memory operable to store:
a first threshold number associated with invalid sign-on attempts, wherein the first threshold number is determined with respect to a first time interval; and
a second threshold number associated with the invalid sign-on attempts, wherein:
the second threshold number is associated with a second time interval; and
the second time interval has a more duration than the first time interval; and

a processor, operably coupled with the memory, and configured to:
detect a first number of invalid sign-on attempts with respect to a plurality of user profiles during the first time interval, wherein the first time interval is from an initial timestamp to a first timestamp;
detect a second number of invalid sign-on attempts with respect to the plurality of user profiles during the second time interval, wherein the second time interval is from the first timestamp to a second timestamp;
determine a difference between the first number of invalid sign-on attempts and the second number of invalid sign-on attempts;
determine whether the difference between the first number of invalid sign-on attempts and the second number of invalid sign-on attempts is more than the first threshold number;
in response to determining that the first number of invalid sign-on attempts is more than the first threshold number, trigger a first alert that indicates detection of a first DoS attack on multiple user profiles during the second time interval;
combine the first number of invalid sign-on attempts and the second number of invalid sign-on attempts;
determine whether the combination of the first number of invalid sign-on attempts and the second number of invalid sign-on attempts is more than the second threshold number; and
in response to determining that the combination of the first number of invalid sign-on attempts and the second number of invalid sign-on attempts is more than the second threshold number, trigger a second alert that indicates detection of a second DoS attack on multiple user profiles during the first time interval and the second time interval.