Multiple detector methods and systems for defeating low and slow application ddos attacks
AssigneeThe University of North Carolina at Charlotte
InventorsEhab AL-SHAER, Qi DUAN
Life of this patent
Estimating the term…
Abstract
Methods and systems for detecting and defeating a low and slow application DDoS attack, comprising: computing the Entropy of a plurality of detectors, at least in part selected from a group Geo detector, a group response size detector, a group preference detector, and an individual client behavior detector, wherein the plurality of detectors each describe a feature of traffic affected by the DDoS attack; composing the plurality of detectors on one or more of a Receiver Operating Characteristic (ROC) curve basis and a correlation basis; and implementing a countermeasure to mitigate the DDoS attack.
Claims26
A method for detecting and defeating a low and slow application Distributed Denial of Service (DDoS) attack, comprising:
- computing the Entropy of a plurality of detectors, at least in part selected from a group Geo detector, a group response size detector, a group preference detector, and an individual client behavior detector, wherein the plurality of detectors each describe a feature of traffic affected by the DDoS attack;
- composing the plurality of detectors on one or more of a Receiver Operating Characteristic (ROC) curve basis and a correlation basis;
- and
- implementing a countermeasure to mitigate the DDoS attack.
A system for detecting and defeating a low and slow application Distributed Denial of Service (DDoS) attack, comprising:
- a processor executing instructions to:
- compute the Entropy of a plurality of detectors, at least in part selected from a group Geo detector, a group response size detector, a group preference detector, and an individual client behavior detector, wherein the plurality of detectors each describe a feature of traffic affected by the DDoS attack;
- compose the plurality of detectors on one or more of a Receiver Operating Characteristic (ROC) curve basis and a correlation basis;
- and
- implement a countermeasure to mitigate the DDoS attack.
Dependencies are inferred from the claim text.