System and method for applying a plurality of interconnected filters to protect a computing device from a distributed denial-of-service attack

A system for applying a plurality of interconnected filters to protect a computing device from a distributed denial-of-service attack, wherein the system comprises:

• a memory device storing one or more filters;
• and
• a processor configured to:
• responsive to detecting the computing device is subject to the distributed denial-of-service (DDoS) attack, intercept data from a network node to the computing device;
• determine one or more data transmission parameters based on the intercepted data;
• assign an initial danger rating to the network node at least based on a network address of the network node;
• identify a subset of the plurality of the interconnected filters which are concurrently triggered;
• change the danger rating of the network node, wherein the change is based on an application of the subset of the plurality of interconnected filters that are triggered and on the data transmission parameters;
• and
• responsive to determining that the danger rating of the network node exceeds a threshold value, limit a transmittal of data from the network node to the computing device by limiting channel capacity between the network node and the computing device.

A non-transitory computer readable medium comprising computer executable instructions for applying a plurality of interconnected filters to protect a computing device from a distributed denial-of-service attack, including instructions for:

• responsive to detecting the computing device is subject to the distributed denial-of-service (DDoS) attack, intercepting data from a network node to the computing device;
• determining one or more data transmission parameters based on the intercepted data;
• assigning an initial danger rating to the network node at least based on a network address of the network node;
• identifying a subset of the plurality of the interconnected filters which are concurrently triggered;
• changing the danger rating of the network node, wherein the change is based on an application of the subset of the plurality of interconnected filters that are triggered and on the data transmission parameters;
• and
• responsive to determining that the danger rating of the network node exceeds a threshold value, limiting a transmittal of data from the network node to the computing device by limiting channel capacity between the network node and the computing device.