Patent ID: 8001601

Claim:
A method for detecting a distributed denial of service attack comprising: collecting a first set of data associated with a first data flow at a router in a service provider network, the first data flow comprising a number of packets transmitted to a customer network over a predetermined period of time; removing noise from an average value of a first characteristic of the first data flow over the predetermined period of time by applying a Fourier transform to the average; detecting whether anomalies are present in the first data flow, each of the anomalies comprising a first deviation from a predicted model of the first data flow, the predicted model being generated as a function of historical data collected at the router and the de-noised average of the value of the first characteristic; clustering the anomalies into events corresponding to a potential distributed denial of service attack, the clustering of the anomalies comprising: calculating a deviation score associated with an observed value of the at least a first characteristic, if the deviation score is above a predetermined value, identifying the observed value as an anomaly, determining whether the anomaly is a new anomaly, and if the anomaly is not a new anomaly, clustering the anomaly as a part of an existing event, the event comprising a plurality of anomalies; filtering the anomalies to remove particular ones of the anomalies occurring for reasons known to be unrelated to distributed denial of service attacks; in response to the detection of the anomalies in the first data flow, receiving a second set of data associated with a second data flow; analyzing at least a portion of the second set of data to determine whether the anomaly represents an attack on a computer network; and generating an alarm if it is determined that the anomaly represents an attack.