Characterization of HTTP flood DDoS attacks

A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:

• generating a plurality of dynamic applicative signatures by analyzing at the application layer application layer requests received during an on-going DDoS attack, wherein a dynamic applicative signature characterizes each received application layer request based on frequent application layer attributes appearing in the received application layer requests;
• characterizing each of the received application layer requests based on one of the generated dynamic applicative signatures, wherein the characterization provides an indication for each received application layer request whether a received application layer request is generated by an attack tool executing the on-going DDoS attributes;
• and
• causing a mitigation action on the received application layer request generated by the attack tool based on the generated dynamic applicative signature.

A system for characterizing application layer denial-of-service (DDoS) attacks, comprising:

• a processing circuitry;
• and
• a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
• generate a plurality of dynamic applicative signatures by analyzing at the application layer application layer requests received during an on-going DDoS attack, wherein a dynamic applicative signature characterizes each received application layer request based on frequent application layer attributes appearing in the received application layer requests;
• characterize each of the received application layer requests based on one of the generated dynamic applicative signatures, wherein the characterization provides an indication for each received application layer request whether a received application layer request is generated by an attack tool executing the on-going DDoS attributes;
• and
• causing a mitigation action on the received application layer request generated by the attack tool based on the generated dynamic applicative signature.