Identifying a potential DDOS attack using statistical analysis

A method of identifying information about a potential attack on a network resource, the method comprising:

• one or more processors performing the steps of:
• receiving a first set of records of requests for target objects of the network resource;
• analyzing the first set of records to determine a primary identifier for each record, the first set of records having a plurality of different primary identifiers, wherein the primary identifier of a record is a user agent of the request;
• for each primary identifier of the plurality of different primary identifiers:
• determining a request number of requests in the first set of records that match one or more criteria, the one or more criteria including the request having the primary identifier;
• determining a plurality of counters, each counter corresponding to a specified number of requests, and a count of different primary identifiers having a corresponding request number be the specified number of requests;
• computing an average number of requests for primary identifiers from the determined counters;
• calculating a standard deviation using the plurality of counters and the average number of requests;
• identifying one or more outlier primary identifiers having the request number exceed a cutoff, the cutoff being based on the calculated standard deviation;
• and
• analyzing the records of requests matching the one or more outlier primary identifiers to determine whether the primary identifier is included in records of requests for one or more additional target objects.