Detecting over-mitigation of network traffic by a network security element

A computer system for monitoring network traffic associated with a plurality of protected network servers to configured to prevent a network security filter from performing over-mitigation of Denial-of-Service (DoS) attacks upon the plurality of protected network servers in a protected computer network, comprising:

• a network security filter configurable to detect presence of a Denial of Service (DoS) attack upon the protected network having the plurality of protected network servers;
• a data intercept device coupled to a computer network configured to intercept data communications occurring between one or more external computers seeking connection with one or more of the protected network servers in the protected computer network, the intercepted data communications comprising captured data packets;
• a Packet Capture (PCAP) capture device coupled to the data intercept device configured and operative to determine whether the captured data packets are associated with non-malicious network traffic;
• a PCAP analyzer device coupled to the PCAP capture device configured and operative to generate a matching pattern of the captured data packets determined non-malicious network traffic;
• a packet generator device coupled to the PCAP analyzer device configured and operative to generate test traffic packets utilizing the matching pattern of the captured data packets determined to be non-malicious network traffic;
• and
• a packet injector device configured and operative to inject the generated test traffic packets into the network security filter to determine if the injected test traffic packets are treated as a DoS attack by the network security filter.

A method performed by a computer system having one or more processors and memory storing one or more programs for execution by the one or more processors for preventing a network security filter from performing over-mitigation of Denial-of-Service (DoS) attacks upon a protected computer network, the method comprising steps of:

• intercepting data communications occurring between one or more external computers in a monitored computer network seeking connection with one or more host devices in the protected computer network, the intercepted data communications comprising captured data packets;
• determining whether the captured data packets are associated with non-malicious network traffic when the protected computer network is not subject to a DoS attack;
• generating a matching pattern of the captured data packets determined non-malicious network traffic;
• generating test traffic packets utilizing the matching pattern of the captured data packets determined to be non-malicious network traffic in accordance with certain time intervals as prescribed by a timer;
• injecting the generated test traffic packets into the network security filter wherein the generated test packets are injected into a secondary port associated with the network security filter, which secondary port is separate from a primary port receiving actual traffic flow for the network security filter from the monitored computer network;
• determining if the injected test traffic packets are treated as a DoS attack by the network security filter;
• and
• providing indication when it is determined the injected test packets are determined to be a DoS attack by the network security filter.