Patent ID: 7617170
Filing Date: 2009-11-10
Classification: G06N,H04L

Abstract:
1. An anomaly detection engine for protecting a web server from hypertext transfer protocol (HTTP) flood attacks, -comprising: an interface to receive a plurality of real-time statistical parameters and a plurality of normal base line values, said plurality of real-time statistical parameters comprising at least one rate-based parameter, at least one rate-invariant parameter, wherein the rate-invariant parameter includes at least HTTP request URL size distribution parameters; an embedded correlation engine for applying embedded correlation rules on at least said received real-time statistical parameters; a degree of anomaly generator for generating a degree of anomaly (DoA) based on said received plurality of real-time statistical parameters, said plurality of normal base line values, deviation analysis of said real-time statistical parameters from said normal base-line values, and said embedded correlation rules; a decision engine for activating at least one trap buffer, when said generated degree of anomaly indicates on a HTTP flood attack, wherein said at least one trap buffer is adapted, based on normal base-line values of the URL size distribution parameters, to characterize the anomaly and create, in real time, a pattern of the anomaly; and a mitigation mechanism for mitigating traffic flows of HTTP flood requests, based on the generated anomaly pattern, thereby protecting said web server from said HTTP flood attacks.