Patent ID: 8407342

Claim:
An architecture for preventing denial of service attacks, the architecture comprising: a traffic velocity monitor (TVM) configured to calculate a first traffic volume of messages destined for one or more devices at a first sampling time and a second traffic volume of messages destined for the one or more devices at a second sampling time, respectively; a traffic acceleration monitor (TAM) accessible to the TVM and configured to: (a) calculate an average traffic acceleration (A avg ) based on an acceleration (A n ) for the sampling times wherein A avg =(sum of each A n )/n, A n =(1−α) A n-1 +α(V n −V n-1 ), n is the second sampling time, n−1 is the first sampling time, A n-1 is a previous acceleration, V n is the second traffic volume of messages, V n-1 is the first traffic volume of messages, and α is a sensitivity factor (0≦α≧1) enabling adjustment of the calculation for A n , and (b) detecting the denial of service attacks by determining whether the average traffic acceleration (A avg ) has crossed a threshold; and a source filter accessible to at least the TVM, wherein the source filter is configured to block traffic from a source to the one or more devices identified by the TVM whenever the TAM detects the denial of service attacks.