Method and apparatus for improving user experience for legitimate traffic of a service impacted by denial of service attack

A system for isolating legitimate network traffic during a denial of service attack, comprising:

• a network interface configured to receive a plurality of packets from a network;
• a classifier operatively connected to the network interface, the classifier configured to be dynamically programmed by an Internet Protocol (IP) stack to send the plurality of packets associated with a connection and determine to which of a plurality of temporary data structures each of the plurality of packets is forwarded,
• wherein the IP stack includes instructions to:
• detect a denial of service attack from the network on a first virtual network stack;
• in response to detecting the attack from the network:
• forward a plurality of packets associated with a subsequent connection to a temporary data structure associated with a second virtual network stack, wherein the temporary data structure associated with the second virtual network stack is a lowest priority queue configured at a setup time of the subsequent connection and is included in the plurality of temporary data structures;
• determine whether the subsequent connection is legitimate;
• and
• forward at least one of the plurality of packets associated with the subsequent connection to a temporary data structure associated with the first virtual network stack if the subsequent connection is legitimate, wherein a higher priority mapping is assigned to the subsequent connection by the classifier, wherein the temporary data structure associated with the first virtual network stack is included in the plurality of temporary data structures, and wherein the first virtual network stack and the second virtual network stack are executing in a single host.