# US 10,771,500 B2 · System and method of determining DDOS attacks

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,771,500 B2
- Document ID: US10771500B2
- Status: Granted
- Kind: B2
- Application number: 15/910,616
- Filed: 2018-03-02
- Published: 2019-01-17
- Granted: 2020-09-08
- Earliest claimed: 2017-07-17
- Assignees: AO Kaspersky Lab
- Applicants: AO Kaspersky Lab
- Inventors: Alexander A. Khalimonenko; Anton V. Tikhomirov; Sergey V. Konoplev
- Web page: https://patentgrep.com/patent/US10771500B2

## CPC

- H04L 63/1458: {Denial of Service}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 67/025: for remote control or remote monitoring of applications
- H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP]
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Disclosed are systems and methods for detecting distributed denial-of-service (DDoS) attack. An exemplary method includes receiving one or more requests from a first user for a service executing on a server, and generating a first vector associated with the first user comprised of a plurality of characteristics indicative of the first user accessing the service; calculating a comparison between the first vector and a reference vector, wherein the reference vector comprises an averaged distribution of characteristics for a plurality of users accessing the service, and determining that the service is under a denial-of-service attack based on the comparison between the first vector and the reference vector.

## Claims

### Claim 1

A method for protecting against a distributed denial-of-service (DDoS) attack, the method comprises:
receiving one or more requests from a first user for a service executing on a server;
generating a first vector associated with the first user comprised of a plurality of characteristics indicative of the first user accessing the service;
calculating a comparison between the first vector and a reference vector, wherein the reference vector comprises an averaged distribution of characteristics for a plurality of users accessing the service;
calculating a difference between the first vector and the reference vector;
responsive to determining that the calculated difference between the first vector and the reference vector exceeds a first threshold value, determining that the service is under a denial-of-service attack, that the first vector is indicative of behavior of repeat access requests of a webpage with a password, and that the first user is a malicious user;
determining that the service is not under a denial-of-service attack and that the first user is a legitimate user responsive to determining the calculated difference is less than a second threshold value; and
handling requests due to a possible cyberattack, shortening a time interval for gathering data for the reference vector, and reducing a threshold value used for the comparison responsive to receiving an indication that the service has ceased.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
gathering data associated with requests for the service associated with the plurality of users, wherein the data comprises path identifiers specified by the requests from the plurality of users; and
generating the reference vector based on the gathered data comprising an averaged frequency of requests by path identifier.

### Claim 3 (depends on 1)

The method of claim 1, further comprising:
generating the reference vector based on gathered data associated with parameters of HTTP requests from the plurality of users.

### Claim 4 (depends on 1)

The method of claim 1, wherein the denial-of-service attack comprises a low-and-slow denial of service attack.

### Claim 5

A system for protecting against a distributed denial-of-service (DDoS) attack, the system comprises:
a memory device; and
a hardware processor configured to:
receive one or more requests from a first user for a service executing on a server;
generate a first vector associated with the first user comprised of a plurality of characteristics indicative of the first user accessing the service;
calculate a comparison between the first vector and a reference vector, wherein the reference vector comprises an averaged distribution of characteristics for a plurality of users accessing the service;
calculate a difference between the first vector and the reference vector;
responsive to determining that the calculated difference between the first vector and the reference vector exceeds a first threshold value, determine that the service is under a denial-of-service attack, that the first vector is indicative of behavior of repeat access requests of a webpage with a password, and that the first user is a malicious user;
determining that the service is not under a denial-of-service attack and that the first user is a legitimate user responsive to determining the calculated difference is less than a second threshold value; and
handling requests due to a possible cyberattack, shortening a time interval for gathering data for the reference vector, and reducing a threshold value used for the comparison responsive to receiving an indication that the service has ceased.

### Claim 6 (depends on 5)

The system of claim 5, wherein the processor is further configured to:
gather data associated with requests for the service associated with the plurality of users, wherein the data comprises path identifiers specified by the requests from the plurality of users; and
generate the reference vector based on the gathered data comprising an averaged frequency of requests by path identifier.

### Claim 7 (depends on 5)

The system of claim 5, wherein the processor is further configured to:
generate the reference vector based on gathered data associated with parameters of HTTP requests from the plurality of users.

### Claim 8 (depends on 5)

The system of claim 5, wherein the denial-of-service attack comprises a low-and-slow denial of service attack.

### Claim 9

A non-transitory computer readable medium comprising computer executable instructions for protecting against a distributed denial-of-service (DDoS) attack, including instructions for:
receiving one or more requests from a first user for a service executing on a server;
generating a first vector associated with the first user comprised of a plurality of characteristics indicative of the first user accessing the service;
calculating a comparison between the first vector and a reference vector, wherein the reference vector comprises an averaged distribution of characteristics for a plurality of users accessing the service;
calculating a difference between the first vector and the reference vector;
responsive to determining that the calculated difference between the first vector and the reference vector exceeds a first threshold value, determining that the service is under a denial-of-service attack, that the first vector is indicative of behavior of repeat access requests of a webpage with a password, and that the first user is a malicious user;
determining that the service is not under a denial-of-service attack and that the first user is a legitimate user responsive to determining the calculated difference is less than a second threshold value; and
handling requests due to a possible cyberattack, shortening a time interval for gathering data for the reference vector, and reducing a threshold value used for the comparison responsive to receiving an indication that the service has ceased.

### Claim 10 (depends on 9)

The non-transitory computer readable medium of claim 9, further comprising instructions for:
gathering data associated with requests for the service associated with the plurality of users, wherein the data comprises path identifiers specified by the requests from the plurality of users; and
generating the reference vector based on the gathered data comprising an averaged frequency of requests by path identifier.

### Claim 11 (depends on 9)

The non-transitory computer readable medium of claim 9, further comprising instructions for:
generating the reference vector based on gathered data associated with parameters of HTTP requests from the plurality of users.

### Claim 12 (depends on 9)

The non-transitory computer readable medium of claim 9, wherein the denial-of-service attack comprises a low-and-slow denial of service attack.