Automatic detection of network strain using response time metrics

A network monitoring system to monitor a protected network for strain, the network monitoring system comprising:

• a memory configured to store instructions;
• and
• a processor disposed in communication with the memory, wherein the processor, upon execution of the instructions is configured to:
• in an analysis phase during operation of the protected network:
• receive a learned model having clusters of learning requests of learning network traffic observed during non-strain operation of the protected network, each cluster having an associated characteristic learning response time based on learning response times determined for learning requests and corresponding learning responses of the learning network traffic;
• observe network traffic having traffic requests and traffic responses to and from the protected network;
• classify each of the traffic requests with one of the clusters by comparing fields of the traffic request to fields used for clustering the learning requests with the clusters;
• associate one of the traffic responses or lack of traffic response to each corresponding traffic request of the clusters;
• determine an analysis response time for the respective traffic responses;
• associate the analysis response time with the respective classified traffic requests that correspond to the traffic responses;
• determine an analysis response time for the respective traffic responses;
• determine a difference per cluster between the analysis response time and the learning response time associated with the cluster;
• and
• notify a mitigation device when the difference determined for enough of the clusters exceeds a predetermined threshold.