Denial of service attacks characterization

A monitoring device for thwarting denial of service attacks on a data center, the monitoring device comprises:

• a computing device executing:
• a process to build at least one histogram for at least one parameter of network traffic;
• and
• a process to characterize an attack based on a comparison of a historical histogram of the at least one parameter to the built at least one histogram for the at least one parameter.

A method of protecting a victim site during a denial of service attack, comprises:

• disposing a gateway device between the victim site and a network;
• monitoring network traffic through the gateway and determining if values of at least one parameter exceed normal, threshold values expected for the parameter to indicate an attack on the site;
• producing a histogram for the at least one parameter of network traffic to characterize the attack by comparing the histogram to at least one historical histogram for that parameter;
• and
• filtering out traffic based on characterizing the traffic, which the gateway deems to be part of an attack.

A method to reduce blocking of legitimate traffic in a process to protect a victim site during a denial of service attack, comprises:

• producing a histogram of network traffic to characterize an attack;
• and
• filtering out traffic deemed part of an attack with filtering comprising:
• constructing a master correlation vector having asserted bits corresponding to the most important parameter correlations;
• initializing a packet's correlation bit vector to 0, and for every parameter:
• retrieving the parameter in a parameter suspicious vector to construct the packet' correlation bit vector;
• and
• using the value of the packet's correlation bit vector to index into the master correlation bit vector.