Dynamic detection of HTTP-based DDoS attacks using estimated cardinality

A monitoring system for detecting a Denial of Service (DoS) attack by detecting changes in recent cardinality of a network traffic flow comprising:

• a monitored network comprising a plurality of devices;
• a storage repository for storing network traffic flow information;
• and
• one or more network monitoring devices communicatively coupled to the monitored network and to the storage repository, wherein the one or more network monitoring devices are configured and operable to:
• receive packets in a traffic flow;
• perform cardinality estimation on the received packet traffic flow using a sliding HyperLogLog (HLL) process that determines a cardinality of defined classes of HTTP traffic at a prescribed time period regarding the received packet traffic flows;
• maintain in the storage repository a series of cardinalities for prior packet traffic flows;
• detect changes in cardinalities associated with prior packet traffic flows compared to determined cardinalities associated with a current packet traffic flow;
• and
• determine an alert condition for the network traffic flow regarding a suspected DoS attack based upon the detected changes in cardinalities regarding comparison of the cardinalities associated with prior packet traffic flows compared to cardinalities of a current packet traffic flow and determining if a determined cardinality associated with packet traffic flows currently received is greater than a calculated geometric mean cardinality of past cardinality values by a prescribed ‘n’ geometric standard deviation of cardinalities.