Application-level denial-of-service attack protection

A method for a computing system to filter at least some incoming application requests for an application such that some application requests are rejected, and some application request are accepted, the method comprising:

• an act of receiving a first application request, wherein the application request includes a token issued by the application;
• an act of classifying the first application request as being of a particular first subset of one or more request classes of a plurality of possible request classes;
• an act of determining a first admission policy to apply based on the particular first subset of one or more request classes corresponding to the first application request, wherein the first admission policy is dependent at least in part upon content of the token included within the first application request;
• an act of applying the determined first admission policy for the first application request, the application of the first admission policy resulting in an acceptance of the first application request;
• an act of receiving a second application request;
• an act of classifying the second application request as being of a particular second subset of one or more request classes of a plurality of possible request classes;
• an act of determining a second admission policy to apply based on the particular second subset of one or more request classes corresponding to the second application request;
• and
• an act of applying the determined second admission policy for the second application request, the application of the second admission policy resulting in a rejection of the second application request.

A non-transitory computer program product comprising one or more physical non-transitory computer-readable media having thereon computer-executable instructions that, when executed by one or more processors of the computing system, cause the computing system to filter at least some incoming application requests for a web service such that some application requests are rejected, some application requests are accepted, and some application request are deferred, by performing the following for each of the at least some incoming application requests:

• an act of classifying the application request as being of a particular subset of one or more request classes of a plurality of possible request classes, wherein the plurality of possible request classes may be altered, wherein the subset of request classes are classified as corresponding to the application request based at least in part on a token issued by the web service, the token provided within the application request, but which token is decipherable based on information shared by the computing system and the web service, but the shared information not being known by the issuer of the application request;
• an act of determining an admission policy to apply based on the particular subset of one or more request classes corresponding to the application request, wherein the admission policy corresponding to the plurality of request classes may also be altered;
• an act of applying the determined admission policy for the application request, the application of the admission policy having at least three possible outcomes including 1) rejecting the application request to thereby not forward the application request to the web service, 2) accepting the application request to thereby forward the application request to the web service, or 3) deferring the application request until a later time, wherein the deferred application message is drawn at a future times from the deferred message pool for further consideration.