Patent ID: 7536552
Filing Date: 2009-05-19
Classification: H04L

Abstract:
1. A method for processing communication traffic, comprising: monitoring the communication traffic that is sent over a network to a destination address; determining a baseline characteristic of the communication traffic while a DDoS attack is not in progress; detecting a deviation from the baseline characteristic that is indicative that at least some of the communication traffic has been sent by zombies having legitimate addresses on the network, wherein the deviation comprises at least one of a variation in a distribution of user agents specified in requests contained in the traffic, a variation in a distribution of source IP addresses, and a recurrence at regular intervals of a pattern of identical incoming data packets; and responsively to detecting the deviation, filtering the communication traffic so as to remove at least some of the communication traffic sent by the zombies, and to leave a first message in the communication traffic from a source computer sent from a source address that requests a first URI in accordance with a higher-level protocol; receiving the first message; sending a challenge to the source address of the first message in accordance with the higher-level protocol that directs the source computer to request a second URI in a second message; receiving the second message; verifying a presence of the second URI in the second message, responsively to verifying the presence of the second URI, accepting subsequent messages from the source address as legitimate.