Automated selection of DDoS countermeasures using statistical analysis

A network attack monitor for automatic selection of countermeasures to an automatically detected Distributed Denial of Service (DDoS) attack, the network attack monitor comprising:

• a memory configured to store instructions;
• a processor and in communication with the memory, wherein the processor upon execution of the instructions is caused to:
• receive a network traffic snapshot of network traffic, wherein packets of the network traffic snapshot each have data stored in respective fields of a set of one or more packet fields;
• generate, from the network traffic snapshot, a statistical data structure that includes a plurality of unique combinations of data stored in the respective fields of the set of one or more packet fields, each of the plurality of unique combinations having an associated counter that is incremented for each occurrence that the combination matches one of the packets of the network traffic snapshot and one or more timestamps indicating when the combination was observed;
• determine an observed vector from the statistical data structure, wherein the observed vector has associated attribute/value pairs that characterize the respective fields of one or more combinations of the plurality of unique combinations formed into a group, wherein the one or more combinations are grouped based on having associated counters that satisfy a predetermined criterion;
• compare the attribute/value pairs associated with the observed vector to known attribute/value pairs associated with known DDoS attack vectors of an attack vector database;
• and
• in response to finding a known attack vector having matching known attribute/value pairs as a result of the comparison, select mitigation parameters associated with the known attack vector, wherein the selected mitigation parameters are used for applying a countermeasure to the network traffic for mitigating an attack.

A non-transitory computer readable storage medium storing one or more computer programs embedded therein, the computer programs comprising instructions, which when executed by a computer system, cause the computer system to:

• receive a network traffic snapshot of network traffic, wherein packets of the network traffic snapshot each have data stored in respective fields of a set of one or more packet fields;
• generate, from the network traffic snapshot, a statistical data structure that includes a plurality of unique combinations of data stored in the respective fields of the set of one or more packet fields, each of the plurality of unique combinations having an associated counter that is incremented for each occurrence that the combination matches one of the packets of the network traffic snapshot and one or more timestamps indicating when the combination was observed;
• determine an observed vector from the statistical data structure, wherein the observed vector has associated attribute/value pairs that characterize the respective fields of one or more combinations of the plurality of unique combinations formed into a group, wherein the one or more combinations are grouped based on having associated counters that satisfy a predetermined criterion;
• compare the attribute/value pairs associated with the observed vector to known attribute/value pairs associated with known Distributed Denial of Service (DDoS) attack vectors of an attack vector database;
• and
• in response to finding a known attack vector having matching known attribute/value pairs as a result of the comparison, select mitigation parameters associated with the known attack vector, wherein the selected mitigation parameters are used for applying a countermeasure to the network traffic for mitigating an attack.