Patent ID: 8549645

Claim:
A distributed denial of service (“DDOS”) detection engine communicatively coupled to a plurality of web servers, the DDOS detection engine comprising: a web server interface configured to: receive a plurality of web log traces from a web server, the web server being one of the plurality of web servers; communicate a first plurality of user classifications to the web server based at least on the plurality of web log traces; and communicate a second plurality of user classifications to the web server based at least on the plurality of web log traces; and a first DDOS analysis engine configured to: extract a first feature vector from the plurality of web log traces, wherein the first feature vector is representative of network traffic on the plurality of web servers over a first period of time; apply a first machine learning technique to the first feature vector; and produce the first plurality of user classifications for communication to the web server in substantially real time; and a second DDOS analysis engine configured to: extract a second feature vector from the plurality of web log traces, wherein the second feature vector is representative of network traffic on the plurality of web servers over a second period of time, the second period of time greater than the first period of time; apply a second machine learning technique to the second feature vector; and produce the second plurality of user classification for communication to the web server.