Network overload detection and mitigation system and method

A system for detecting an overload condition targeting one or more of a plurality of networked computer systems, comprising:

• a network connection for receiving a volume of data, Din, over a time period, Pin, from attacking coputers located on a network;
• and
• a meter to detect the presence of an overload condition and data associated therewith, the overload condition being mitigated by one or more attack mitigation modules, the overload condition being directed to one or more of a plurality of target computers located on the network, the attack mitigation modules producing a volume of clean data from which all data detected to be bearing one or more characteristics determined to be associated with attempted overload conditions has been removed, Dout, over a time period, Pout, wherei the time period, Pout, is equal to the time period, Pin, the meter detecting the presence of the mitigated overload condition attempt when Dout divided by Pout is substantially less than Din divided by Pin;
• wherein the one or more attack mitigation modules function to remove the data detected to be bearing the one or more characteristics determined to be assocated with attempted overload conditions at least at a time before the meter has detected the presence of the mitigated overload condition attempt.

A method for detecting and mitigating an attempted overload condition targeting one or more of a plurality of networked computer systems, comprising:

• receiving a volume of data, Din, over a time period, Pin, from one or more first computers located on a network;
• detecting data, within the received data and directed to one or more of a plurality of second computers located on the network, that bears one or more characteristics determined to be associated with attempted overload conditions;
• producing a volume of clean data from which all data detected to be bearing one or more of the characteristics determined to be associated with attempted overload conditions has been removed, Dout, over a time period, Pout, wherein the time period, Pout, is equal to the time period, Pin;
• and
• detecting the presence of a mitigated overload condition attempt if Doutdivided by Pout is substantially less than Din divided by Pin;
• wherein removal of the data detected to be bearing the one or more of the characteristics determined to be associated with attempted overload conditions occurs at least at a time before detecting the presence of the mitigated overload condition attempt.

A system for detecting an attempted overload condition targeting one or more of a plurality of networked computer systems, comprising:

• a network connection for receiving a volume of data, Din, over a time period, Pin, from one or more first computers located on a network;
• and
• a meter to detect the presence of an attempted overload condition and data associated therewith, the overload condition being mitigated by one or more attack mitigation modules, the attempted overload condition being directed to one or more of a plurality of second computers located on the network, the attack mitigation modules producing a volume of clean data from which all data detected to be bearing one or more characteristics determined to be associated with attempted overload conditions has been removed, Dout, over a time period, Pout, wherein the time period, Pout, is equal to the time period, Pin, the meter detecting the presence of the mitigated overload condition attempt when Dout divided by Pout is substantially less than Din divided by Pin;
• wherein the one or more attack mitigation modules function to remove the data detected to be bearing the one or more of the characteristics determined to be associated with attempted overload conditions at least at a time before the meter has detected the presence of the mitigated overload condition attempt.

A method for detecting an attempted overload condition targeting one or more of a plurality of networked computer systems, comprising:

• receiving a volume of data, Din, over a time period, Pin, from one or more first computers located on a network;
• and
• detecting data, within the received data and directed to one or more of a plurality of second computers located on the network, that bears one or more characteristics determined to be associated with attempted overload conditions;
• wherein a volume of clean data from which all data detected to be associated with the attempted overload condition has been removed, Dout, is produced over a time period, Pout, wherein the time period, Pout, is equal to the time period, Pin;
• wherein detecting comprises determining the presence of the mitigated overload condition attempt if Dout divided by Pout is substantially less than Din divided by Pin;
• and
• wherein removal of the data detected to be bearing the one or more of the characteristics determined to be associated with attempted overload conditions occurs at least at a time before detecting the presence of the mitigated overload condition attempt.

A system for mitigating an overload condition targeting one or more of a plurality of networked computer systems, comprising:

• a network connection for receiving a volume of data, Din, over a time period, Pin, from one or more first computers located on a network;
• and
• a meter to detect the presence of an overload condition and data associated therewith, the overload condition being mitigated by one or more attack mitigation modules, the overload condition being directed to one or more of a plurality of second computers located on the network, the attack mitigation modules producing a volume of clean data from which all data detected to be bearing one or more characteristics determined to be associated with attempted overload conditions has been removed, Dout, over a time period, Pout, wherein the time period, Pout, is equal to the time period, Pin, the meter detecting the presence of the mitigated overload condition attempt when Dout divided by Pout is substantially less than Din divided by Pin;
• wherein the one or more attack mitigation modules function to remove the data detected to be bearing the one or more of the characteristics determined to be associated with attempted overload conditions at least at a time before the meter has detected the presence of the mitigated overload condition attempt.

A method for mitigating an overload condition targeting one or more of a plurality of networked computer systems, comprising:

• receiving a volume of data, Din, over a time period, Pin, from one or more first computers located on a network;
• mitigating the overload condition using one or more of a plurality of mitigation modules, the overload condition being directed to one or more of a plurality of second computers located on the network, wherein a mitigation of the overload condition produces a volume of clean data from which all data that has been detected to be bearing one or more characteristics determined to be associated with attempted overload conditions has been removed, Dout, over a time period, Pout, wherein the time period, Pout, is equal to the time period, Pin;
• and
• determining the presence of the mitigated overload condition attempt if Dout divided by Pout is substantially less than Din divided by Pin;
• wherein removal of the data detected to be bearing the one or more of the characteristics determined to be associated with attempted overload conditions occurs at least at a time before detecting the presence of the mitigated overload condition attempt.