Denial-of-service (dos) mitigation approach based on connection characteristics

A method comprising:

• establishing, within a Denial-of-Service (DoS) mitigation device logically interposed between a protected resource of a private network (“protected network resource”) and a plurality of client devices residing external to the private network, a resource consumption threshold;
• tracking, for each client device of the plurality of client devices, by the DoS mitigation device, an amount of resources of the protected network resource being consumed by the client device;
• and
• tracking, by the DoS mitigation device, a number of connections between the plurality of client devices and the protected network resource;
• and
• during a period of time in which the number of connections exceeds a connection count threshold:
• comparing, by the DoS mitigation device, for each client device of the plurality of client devices, the amount of resources being consumed by the client deviceto the resource consumption threshold;
• and
• responsive to a determination that the amount of resources being consumed by a particular client device exceeds the resource consumption threshold, dropping, by the DoS mitigation device, those of the connections associated with the particular client device, whereby, during the period of time, only those connections of the connections with client devices, if any, of the plurality of client devices complying with the resource consumption threshold are maintained.

A non-transitory computer-readable storage medium embodying a set of instructions, which when executed by one or more processors of a Denial-of-Service (DoS) mitigation device logically interposed between a protected resource of a private network (“protected network resource”) and a plurality of client devices residing external to the private network, cause the one or more processors to perform a method comprising:

• establishing a current threshold for a network connection characteristic;
• tracking a number of connections between the plurality of client devices and the protected network resource;
• and
• during a period of time in which the number of connections exceeds a connection count threshold:
• comparing, for each of the connections, a measured value for the network connection characteristic to the current threshold;
• and
• responsive to a determination that the measured value exceeds the current threshold, causing the connection to be dropped;
• and
• periodically reducing the current threshold by a predetermined amount, whereby, during the period of time, only those connections, if any, of the connections complying with the current threshold are maintained.

A non-transitory computer-readable storage medium embodying a set of instructions, which when executed by one or more processors of a Denial-of-Service (DoS) mitigation device logically interposed between a protected resource of a private network (“protected network resource”) and a plurality of client devices residing external to the private network, cause the one or more processors to perform a method comprising:

• establishing a resource consumption threshold;
• tracking, for each client device of the plurality of client devices an amount of resources of the protected network resource being consumed by the client device;
• and
• tracking a number of connections between the plurality of client devices and the protected network resource;
• and
• during a period of time in which the number of connections exceeds a connection count threshold:
• comparing for each client device of the plurality of client devices, the amount of resources being consumed by the client device to the resource consumption threshold;
• and
• responsive to a determination that the amount of resources being consumed by a particular client device exceeds the resource consumption threshold, causing those of the connections associated with the particular client device to be dropped, whereby, during the period of time, only those connections of the connections with client devices, if any, of the plurality of client devices complying with the resource consumption threshold are maintained.