Unobtrusive and dynamic DDoS mitigation

A device comprising:

• a non-transitory computer-readable medium storing a set of processor-executable instructions;
• and
• one or more processors configured to execute the set of processor-executable instructions, wherein executing the set of processor-executable instructions causes the one or more processors to:
• track different requests for a plurality of different content;
• determine a different request rate for each content of the plurality of content based on said tracking of the different requests;
• activate attack protections for first content in response the request rate for the first content exceeding a first content attack threshold, wherein said activating attack protections comprises creating computational overhead on a first set of machines requesting the first content without imposing said overhead on a second set of machines requesting other content of the plurality of content, said computational overhead comprising a sequence of operations for solving a bot detection problem by execution of the first set of machines without user involvement;
• restrict access to said first content in response to a new request for the first content comprising no solution or an incorrect solution to the bot detection problem;
• and
• send second content from the plurality of content in response to a new request for the second content and tracking the requests for the second content to be less than a second content attack threshold.

A non-transitory computer-readable medium, storing a set of processor-executable instructions, which, when executed by one or more processors, cause the one or more processors to:

• track different requests for a plurality of different content;
• determine a different request rate for each content of the plurality of content based on said tracking of the different requests;
• activate attack protections for first content in response the request rate for the first content exceeding a first content attack threshold, wherein said activating attack protections comprises creating computational overhead on a first set of machines requesting the first content without imposing said overhead on a second set of machines requesting other content of the plurality of content, said computational overhead comprising a sequence of operations for solving a bot detection problem by execution of the first set of machines without user involvement;
• restrict access to said first content in response to a new request for the first content comprising no solution or an incorrect solution to the bot detection problem;
• and
• send second content from the plurality of content in response to a new request for the second content and said tracking the requests for the second content to be less than a second content attack threshold.