Information security system and method for denial-of-service detection

A method for Denial-of-Service (DoS) attack detection comprising:

• detecting a first number of invalid sign-on attempts with respect to a plurality of user profiles during a first time interval, wherein the first time interval is from an initial timestamp to a first timestamp;
• detecting a second number of invalid sign-on attempts with respect to the plurality of user profiles during a second time interval, wherein the second time interval is from the first timestamp to a second timestamp;
• determining a difference between the first number of invalid sign-on attempts and the second number of invalid sign-on attempts;
• determining whether the difference between the first number of invalid sign-on attempts and the second number of invalid sign-on attempts is more than a first threshold number, wherein:
• the first threshold number is associated with invalid sign-on attempts, and
• the first threshold number is determined with respect to the first time interval;
• in response to determining that the first number of invalid sign-on attempts is more than the first threshold number, triggering a first alert that indicates detection of a first DoS attack on multiple user profiles during the second time interval;
• combining the first number of invalid sign-on attempts and the second number of invalid sign-on attempts;
• determining whether the combination of the first number of invalid sign-on attempts and the second number of invalid sign-on attempts is more than a second threshold number, wherein:
• the second threshold number is associated with the second time interval, and
• the second time interval has a more duration than the first time interval;
• and
• in response to determining that the combination of the first number of invalid sign-on attempts and the second number of invalid sign-on attempts is more than the second threshold number, triggering a second alert that indicates detection of a second DoS attack on multiple user profiles during the first time interval and the second time interval.

A non-transitory computer-readable medium storing instructions that when executed by a processor cause the processor to:

• detect a first number of invalid sign-on attempts with respect to a plurality of user profiles during a first time interval, wherein the first time interval is from an initial timestamp to a first timestamp;
• detect a second number of invalid sign-on attempts with respect to the plurality of user profiles during a second time interval, wherein the second time interval is from the first timestamp to a second timestamp;
• determine a difference between the first number of invalid sign-on attempts and the second number of invalid sign-on attempts;
• determine whether the first number of invalid sign-on attempts is more than a first threshold number, wherein:
• the first threshold number is associated with invalid sign-on attempts, and
• the first threshold number is determined with respect to the first time interval;
• in response to determining that the difference between the first number of invalid sign-on attempts and the second number of invalid sign-on attempts is more than the first threshold number, trigger a first alert that indicates detection of a first DoS attack on multiple user profiles during the second time interval;
• combine the first number of invalid sign-on attempts and the second number of invalid sign-on attempts;
• determine whether the combination of the first number of invalid sign-on attempts and the second number of invalid sign-on attempts is more than a second threshold number, wherein:
• the second threshold number is associated with the second time interval, and
• the second time interval has a more duration than the first time interval;
• and
• in response to determining that the combination of the first number of invalid sign-on attempts and the second number of invalid sign-on attempts is more than the second threshold number, trigger a second alert that indicates detection of a second DoS attack on multiple user profiles during the first time interval and the second time interval.