Network attack defense system and method

A system, comprising:

• one or more processors configured to:
• obtain a set of one or more statistical attributes for a protected site by gathering statistics for a set of one or more site attributes of the protected site, the set of one or more site attributes indicating an operation mode of the protected site;
• determine, based on the set of one or more statistical attributes, that the protected site is to transition from a current operation mode to a target operation mode, wherein the current operation mode has a current defense strategy and the target operation mode has a target defense strategy, and wherein the current defense strategy differs from the target defense strategy;
• and
• in response to the determination that the protected site is to transition from the current operation mode to the target operation mode, transition from the current operation mode to the target operation mode and apply the target defense strategy for the protected site instead of the current operation mode;
• and
• one or more memories coupled to the one or more processors and configured to provide the one or more processors with instructions.

A computer program product for network attack defense, the computer program product being embodied in a tangible computer readable storage medium and comprising computer instructions for:

• obtaining a set of one or more statistical attributes for a protected site by gathering statistics for a set of one or more site attributes of the protected site, the set of one or more site attributes indicating an operation mode of the protected site;
• determining, based on the set of one or more statistical attributes, that the protected site is to transition from a current operation mode to a target operation mode, wherein the current operation mode has a current defense strategy and the target operation mode has a target defense strategy, and wherein the current defense strategy differs from the target defense strategy;
• and
• in response to the determination that the protected site is to transition from the current operation mode to the target operation mode, transitioning from the current operation mode to the target operation mode and applying the target defense strategy for the protected site instead of the current operation mode.