Patent ID: 7921462

Claim:
A method of detecting a distributed denial of service (DDoS) attack in the Internet, the method comprises the steps of: using a sampling unit for sampling packets at a point in the Internet during a number of time intervals of a first predetermined time period during which the packets are received to obtain data pertaining to source addresses of packets and the time intervals associated with receipt of the packets; and using an analyzing device for: analyzing said data to obtain, for each of the time intervals associated with the receipt of the packets, at least one parameter relating to a packet metric for packets received at said point from respective specified geographical regions; and for a particular time interval of a next predetermined time period, comparing a packet metric parameter for packets received in the particular time interval from a specified geographical region with a threshold derived from the at least one packet metric parameter obtained for a corresponding time interval of the first predetermined time period, the result of said comparison being used to determine an existence of a DDoS attack.