Method and system for detection of encrypted distributed denial of service (DDOS) attacks

A non-transitory computer-readable medium storing a set of instructions for detecting encrypted distributed denial of service (DDoS) attacks, the set of instructions comprising:

• one or more instructions that, when executed by one or more processors of a device, cause the device to:
• monitor encrypted transactions related traffic;
• derive from the encrypted transactions rate-based parameters and rate-invariant parameters, wherein the rate-based parameters and rate-invariant parameters are associated with transport layer security (TLS) fingerprints (FPs);
• compare values of the rate-based parameters and the rate-invariant parameters respectively to at least one rate-based anomaly threshold and at least one rate-invariant anomaly threshold;
• and
• declare a detected encrypted DDoS attack when both the at least one rate-based anomaly threshold and the at least one rate-invariant anomaly threshold are exceeded.

A system for detecting encrypted distributed denial of service (DDoS) attacks comprising:

• one or more processors configured to:
• monitor encrypted transactions related traffic;
• derive from the encrypted transactions rate-based parameters and rate-invariant parameters, wherein the rate-based parameters and rate-invariant parameters are associated with transport layer security (TLS) fingerprints (FPs);
• compare values of the rate-based parameters and the rate-invariant parameters respectively to at least one rate-based anomaly threshold and at least one rate-invariant anomaly threshold;
• and
• declare a detected encrypted DDoS attack when both the at least one rate-based anomaly threshold and the at least one rate-invariant anomaly threshold are exceeded.