Identification of attack flows in a multi-tier network topology

A computer program product for providing network protection, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to:

• calculate a latency distribution of one or more connections to each IP address in a network to obtain a maximum latency of the latency distribution;
• determine whether an incoming connection comprising one or more packets has a latency larger than a trigger latency, wherein the trigger latency is at least two times as much as the maximum latency;
• determine whether an attack is currently in progress;
• and
• when the attack is in progress, inject at least one of the one or more packets of the incoming connection or one or more packets of an outgoing connection with a false latency that is the same as the trigger latency.

A system for providing network protection, comprising:

• a processor coupled to a memory, configured to:
• calculate a latency distribution of one or more connections to each IP address in a network to obtain a maximum latency of the latency distribution;
• determine whether an incoming connection comprising one or more packets has a latency larger than a trigger latency, wherein the trigger latency is at least two times as much as the maximum latency;
• determine whether an attack is currently in progress;
• and
• when the attack is in progress, inject at least one of the one or more packets of the incoming connection or one or more packets of an outgoing connection with a false latency that is the same as the trigger latency.