Patent ID: 7587760

Claim:
A method, comprising: identifying an emanation point operable to transmit a plurality of automated messages; transmitting the plurality of automated messages from the identified emanation point to a predetermined collector operable to intercept the automated messages, where the automated messages are tagged probes, where the predetermined collector is to identify tagged probes and obtain characteristics of the automated messages for successive identification of later received messages, and where the tagged probes are sent at a controlled rate sufficient to avoid undesirable operation from excessive tagged probes, the tagged probes emulating aspects of an actual DDoS attack; gathering characteristics of later received messages, where the characteristics identify successive messages emanating from the emanation point; building a repository of gathered characteristics to compare to incoming messages to be analyzed; correlating successive messages with the gathered characteristics to identify suspect messages emanating from an identified anonymous emanation point evaluating a signature of the suspect messages identified as emanating from the identified anonymous emanation point with a corresponding signature from the repository of gathered characteristics; determining a likelihood that the suspect messages identified as emanating from the identified anonymous emanation point emanate from a suspect emanation point; and providing a signal that identifies undesirable message traffic based on the likelihood.