Techniques for detecting advanced application layer flood attack tools

A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:

• detecting application layer flood denial-of-service (DDOS) attacks carried by attackers utilizing advanced application layer flood attack tools, comprising:
• processing application-layer transactions received during a current time window to detect a rate-based anomaly in a traffic directed to a protected entity;
• processing the received application-layer transactions to determine a rate-invariant anomaly based on a plurality of Application Attributes (AppAttributes) observed in the application-layer transactions received during the current time window, wherein the rate-invariant anomaly is determined based on a continuously updated baseline of AppAttributes, wherein AppAttributes represent applicative behavior of the protected entity modeled based on the application-layer transactions;
• determining based on a detected rate-based anomaly and the determined rate-invariant anomaly if an application layer flood DDOS is present in the current time window;
• and
• causing a mitigation action when the application layer flood DDOS is present.

A system for detecting application layer flood denial-of-service (DDOS) attacks carried by attackers utilizing advanced application layer flood attack tools, comprising:

• a processing circuitry;
• and
• a memory, the memory containing instructions that, when executed by the processing circuitry, configure the processing circuitry to:
• process application-layer transactions received during a current time window to detect a rate-based anomaly in a traffic directed to a protected entity;
• process the received application-layer transactions to determine a rate-invariant anomaly based on a plurality of Application Attributes (AppAttributes) observed in the application-layer transactions received during the current time window, wherein the rate-invariant anomaly is determined based on a continuously updated baseline of AppAttributes, wherein AppAttributes represent applicative behavior of the protected entity modeled based on the application-layer transactions;
• determine, based on a detected rate-based anomaly and the determined rate-invariant anomaly, if an application layer flood DDOS is present in the current time window;
• and
• cause a mitigation action when the application layer flood DDOS is present.