Method and system for providing ddos protection by detecting changes in a preferred set of hierarchically structured items in stream data

A method for protecting against denial of service (DoS) attacks by detecting changes in a preferred set of hierarchically-structured items in a network data stream, comprising:

• capturing network traffic from a network data stream from a plurality of network routers coupled to the network data stream;
• collecting the captured network traffic in a plurality of network traffic collectors wherein each of the network traffic collectors is respectively coupled to a respective network router in the plurality of network routers and wherein each of the network traffic collectors includes a network traffic counter, reads destination host addresses and bytes counts present in the captured network traffic, maintains a limited set of network traffic counters for tracking network traffic to host addresses, tracks network traffic to a configured set of network prefixes containing the host addresses, wherein each of the network traffic counters in the limited set of the network traffic counters is maintained using a Hierarchically Heavy Hitters (H3PREF) algorithm and whereby each of the network traffic collectors is further coupled to a common leader nodal device;
• querying, upon detection of a DoS attack, by the common leader nodal device, each of the coupled network traffic collectors to obtain network counter values and Internet Protocol (IP) prefixes tracked by each of the coupled network traffic collectors;
• identifying, by the common leader nodal device, a set of network destination prefixes that account for a user specified target of the DoS attack utilizing the obtained network counter values and IP prefixes;
• tracking, by the common leader nodal device, changes in the attack traffic profile present in the DoS attack;
• generating, by the common leader nodal device, new sets of network destination prefixes when the DoS attack has shifted by a predetermined threshold;
• and
• translating, by the common leader nodal device, sets of identified destination prefixes into route announcements via the generated new sets of network destination prefixes to divert attack traffic of the DoS attack to mitigation devices.