Automatic Detection and Mitigation of Denial-of-Service Attacks

A system comprising:

• data processing hardware, and
• memory hardware in communication with the data processing hardware, the memory hardware storing instructions that when executed on the data processing hardware cause the data processing hardware to perform operations comprising:
• obtaining a first set of network traffic messages representative of network traffic currently received by a network service;
• determining, via a first model, whether network abuse is occurring based on the first set of network traffic messages;
• when the network abuse is occurring:
• obtaining a second set of network traffic messages representative of network traffic currently received by the network service;
• for each network traffic message in the second set of network traffic messages, labeling, via a second model, the network traffic message as an abusing network traffic message participating in the network abuse or a non-abusing network traffic message not participating in the network abuse;
• and
• generating, via a third model, at least one network traffic rule, each network traffic rule configured to be implemented by a firewall and, when implemented, reduce an effect of the abusing network traffic messages.