Patent ID: 7788718
Filing Date: 2010-08-31
Classification: H04L

Abstract:
1. A method of identifying a distributed denial of service attack executed by a computer programmed to perform the steps of: determining a rate profile corresponding to information transfer rates at which information is received from a network, utilizing a processor, said rate profile including a plurality of information transfer rate values, each information transfer rate value representing a sampled rate at which information is transferred, and said rate profile including a plurality of bins each representative of a different information transfer rate magnitude, wherein each information transfer rate value is added to one of the bins based on a magnitude of the information transfer rate value such that each bin represents a number of occurrences of information transfer rates with magnitudes that match the information transfer rate magnitude represented by the bin; establishing a burst magnitude threshold based upon said rate profile; calculating a burst duration profile characterizing periods of time during which said information transfer rate exceeds said burst magnitude threshold; defining a burst duration threshold based upon said burst duration profile; identifying a distributed denial of service attack when said information transfer rate exceeds said burst magnitude threshold for a period of time exceeding said burst duration threshold; updating said rate profile to reflect a change in said information transfer rate, so as to create an updated rate profile; and revising said burst magnitude threshold based upon said updated rate profile; wherein said rate profile is updated based on a rate percentile profile, the rate percentile profile including a same number of bins as said rate profile, each of the bins of the rate percentile profile assigned to one of the bins of said rate profile and storing a percentage of identified information transfer rate values that are equal to or less than the information transfer rate magnitude of the one of the bins of said rate profile to which the bin of the percentile profile is assigned.