A method for protecting against a low-and-slow distributed denial-of-service, DDOS, attack, the method comprises: receiving, during a time interval, at a server, one or more requests from a first user for accessing a service executing on the server; generating, by a protection module connected to the server, a first vector associated with the first user comprised of a plurality of characteristics indicative of the first user accessing the service during the time interval; calculating, by the protection module, a comparison between the first vector and a reference vector, wherein the reference vector comprises an averaged distribution of characteristics for a plurality of users accessing the service; calculating, by the protection module, a difference between the first vector and the reference vector; and responsive to determining that the calculated difference between the first vector and the reference vector exceeds a first threshold value, determining, by the protection module, that the service is under a denial-of-service attack and that the first user is a malicious user; responsive to determining the calculated difference is less than a second threshold value, determining, by the protection module, that the service is not under a denial-of-service attack and that the first user is a legitimate user, wherein the second threshold value is different from the first threshold value; responsive to determining that the service is not under a denial-of-service attack, sending information about the first user to a security application, when determining that the first vector associated with the first user is atypical; receiving, by the protection module from the security application, an indication that the service has ceased handling requests due to a possible low-and-slow DDOS attack, in response to the security application determining that a cyberattack is occurring based on the information about the first user; and responsive to receiving, by the protection module from the security application, the indication that the service has ceased handling requests due to a possible low-and-slow DDOS attack, shortening the time interval, and reducing the second threshold value. receiving, during a time interval, at a server, one or more requests from a first user for accessing a service executing on the server; generating, by a protection module connected to the server, a first vector associated with the first user comprised of a plurality of characteristics indicative of the first user accessing the service during the time interval; calculating, by the protection module, a comparison between the first vector and a reference vector, wherein the reference vector comprises an averaged distribution of characteristics for a plurality of users accessing the service; calculating, by the protection module, a difference between the first vector and the reference vector; and responsive to determining that the calculated difference between the first vector and the reference vector exceeds a first threshold value, determining, by the protection module, that the service is under a denial-of-service attack and that the first user is a malicious user; responsive to determining the calculated difference is less than a second threshold value, determining, by the protection module, that the service is not under a denial-of-service attack and that the first user is a legitimate user, wherein the second threshold value is different from the first threshold value; responsive to determining that the service is not under a denial-of-service attack, sending information about the first user to a security application, when determining that the first vector associated with the first user is atypical; receiving, by the protection module from the security application, an indication that the service has ceased handling requests due to a possible low-and-slow DDOS attack, in response to the security application determining that a cyberattack is occurring based on the information about the first user; and responsive to receiving, by the protection module from the security application, the indication that the service has ceased handling requests due to a possible low-and-slow DDOS attack, shortening the time interval, and reducing the second threshold value.