Dynamic rate limiting for mitigating distributed denial-of-service attacks
AssigneeMicrosoft Technology Licensing, LLC
InventorsShoufu Luo, Jie Zhang
Life of this patent
Estimating the term…
Abstract
The disclosed embodiments provide a system for mitigating a distributed denial-of-service (DDoS) attack. During operation, the system analyzes application layer data in historical traffic to an online system to determine a historical volume of member traffic from an Internet Protocol (IP) address to the online system, wherein the member traffic is generated by members of the online system. Next, the system calculates a rate limit for a set of requests from the IP address to the online system based on the historical volume of member traffic from the IP address. During a DDoS attack, the system outputs the rate limit for use in blocking a subset of the requests from the IP address to the online system.
Claims20
A method comprising:
- analyzing, by one or more computer systems, application layer data in historical traffic to an online system to determine a historical volume of member traffic from an Internet Protocol (IP) address to the online system, wherein the member traffic is generated by members of the online system;
- calculating, by the one or more computer systems, a rate limit for a set of requests from the IP address to the online system based on the historical volume of member traffic from the IP address;
- wherein calculating the rate limit comprises estimating an importance of the IP address based on a number of the members of the online system associated with the historical volume of member traffic from the IP address and a growth rate for the number of the members of the online system associated with the IP address;
- and
- during a distributed denial-of-service (DDoS) attack, outputting the rate limit for use in blocking a subset of the set of requests from the IP address to the online system.
A system comprising:
- one or more processors;
- and
- memory storing instructions that, when executed by the one or more processors, cause the system to:
- analyze application layer data in historical traffic to an online system to determine a historical volume of member traffic from an Internet Protocol (IP) address to the online system, wherein the member traffic is generated by members of the online system;
- calculate a rate limit for a set of requests from the IP address to the online system based on the historical volume of member traffic from the IP address;
- wherein calculating the rate limit comprises estimating an importance of the IP address based on a number of the members of the online system associated with the historical volume of member traffic from the IP address and a growth rate for the number of the members of the online system associated with the IP address;
- and
- during a distributed denial-of-service (DDoS) attack, output the rate limit for use in blocking a subset of the set of requests from the IP address to the online system.
A non-transitory computer-readable storage medium storing instructions that, when executed by a computer, cause the computer to perform a method, the method comprising:
- analyzing application layer data in historical traffic to an online system to determine a historical volume of member traffic from an Internet Protocol (IP) address to the online system, wherein the member traffic is generated by members of the online system;
- calculating a rate limit for a set of requests from the IP address to the online system based on the historical volume of member traffic from the IP address;
- wherein calculating the rate limit comprises estimating an importance of the IP address based on a number of the members of the online system associated with the historical volume of member traffic from the IP address and a growth rate for the number of the members of the online system associated with the IP address;
- and
- during a distributed denial-of-service (DDoS) attack, outputting the rate limit for use in blocking a subset of the set of requests from the IP address to the online system.
Dependencies are inferred from the claim text.