Patent ID: 7624084

Claim:
A method for protecting a web server from hypertext transfer protocol (HTTP) flood attacks by detecting an anomaly in an HTTP request, wherein said method is implemented in a server accessible over a network, comprising: receiving a plurality of real-time statistical parameters and a plurality of normal base line values, said plurality of real-time statistical parameters comprising at least one rate-based parameter, at least one rate-invariant parameter, wherein the rate-invariant parameter includes at least HTTP request URL size distribution parameters; applying a plurality of embedded correlation rules on at least said received real-time statistical parameters; generating, by a degree of anomaly generator, a degree of anomaly (DoA) based on said received plurality of real-time statistical parameters, said plurality of normal base line values, deviation analysis of said real-time statistical parameters from said normal base-line values, and said embedded correlation rules; when said generated degree of anomaly indicates a HTTP flood attack, characterizing the anomaly using at least one trap buffer and based on normal base-line values of the URL size distribution parameters; and mitigating based on the characterized anomaly, by a mitigation mechanism, traffic flows of HTTP flood requests, thereby protecting said web server from said HTTP flood attacks.