System and method of determining DDOS attacks

A system for protecting against a distributed denial-of-service (DDoS) attack, the system comprises:

• a memory device;
• and
• a hardware processor configured to:
• receive one or more requests from a first user for a service executing on a server;
• generate a first vector associated with the first user comprised of a plurality of characteristics indicative of the first user accessing the service;
• calculate a comparison between the first vector and a reference vector, wherein the reference vector comprises an averaged distribution of characteristics for a plurality of users accessing the service;
• calculate a difference between the first vector and the reference vector;
• responsive to determining that the calculated difference between the first vector and the reference vector exceeds a first threshold value, determine that the service is under a denial-of-service attack, that the first vector is indicative of behavior of repeat access requests of a webpage with a password, and that the first user is a malicious user;
• determining that the service is not under a denial-of-service attack and that the first user is a legitimate user responsive to determining the calculated difference is less than a second threshold value;
• and
• handling requests due to a possible cyberattack, shortening a time interval for gathering data for the reference vector, and reducing a threshold value used for the comparison responsive to receiving an indication that the service has ceased.

A non-transitory computer readable medium comprising computer executable instructions for protecting against a distributed denial-of-service (DDoS) attack, including instructions for:

• receiving one or more requests from a first user for a service executing on a server;
• generating a first vector associated with the first user comprised of a plurality of characteristics indicative of the first user accessing the service;
• calculating a comparison between the first vector and a reference vector, wherein the reference vector comprises an averaged distribution of characteristics for a plurality of users accessing the service;
• calculating a difference between the first vector and the reference vector;
• responsive to determining that the calculated difference between the first vector and the reference vector exceeds a first threshold value, determining that the service is under a denial-of-service attack, that the first vector is indicative of behavior of repeat access requests of a webpage with a password, and that the first user is a malicious user;
• determining that the service is not under a denial-of-service attack and that the first user is a legitimate user responsive to determining the calculated difference is less than a second threshold value;
• and
• handling requests due to a possible cyberattack, shortening a time interval for gathering data for the reference vector, and reducing a threshold value used for the comparison responsive to receiving an indication that the service has ceased.