Application-level DDoS detection using service profiling

A system for detecting a malicious network activity, comprising:

• a processor and memory;
• a feature sequence generator comprising instructions stored in the memory, when executed on the processor having functionality to:
• extract, based on a first pre-determined criterion and from a network traffic session exchanged during a protection phase between a server device and a client device of a network, a plurality of consecutive segments, wherein each of the plurality of consecutive segments comprises a sequence of consecutive packets exchanged between the server device and the client device;
• extract, based on a second pre-determined criterion, a feature sequence from each of the plurality of consecutive segments, wherein the feature sequence comprises a sequence of feature vectors corresponding to and representing the sequence of consecutive packets, each feature vector corresponding to a packet in the sequence of consecutive packets and including:
• a packet direction, a packet payload length of a server transmitted packet, a packet payload length range of a client transmitted packet, packet flags, and a packet inter-arrival time;
• including the feature sequence in a plurality of protection phase feature sequences extracted from a first plurality of network traffic sessions exchanged during the protection phase between the server device and a first plurality of client devices of the network, wherein the plurality of protection phase feature sequences are extracted from the plurality of network traffic sessions based on the first pre-determined criterion and the second pre-determined criterion;
• and
• extract a plurality of profiling phase feature sequences that were extracted from a second plurality of network traffic sessions exchanged during a profiling phase prior to the protection phase between the server device and a second plurality of client devices of the network;
• a malicious activity detector comprising instructions stored in the memory, when executed on the processor having functionality to:
• compare the plurality of protection phase feature sequences and the plurality of profiling phase feature sequences to generate a comparison result wherein generating a comparison result includes extracting, from the plurality of protection phase feature sequences, a set of suspicious feature sequences by excluding any feature sequence not found in the plurality of profiling phase feature sequences;
• and
• generate, in response to detecting a statistical measure of the comparison result exceeding a pre-determined threshold, an alert indicating the malicious network activity;
• and
• a repository for storing the plurality of profiling phase feature sequences, the plurality of protection phase feature sequences, and the plurality of suspicious feature sequences.

A non-transitory computer readable medium embodying instructions for detecting a malicious network activity, the instructions when executed by a processor of a computer, comprising functionality for:

• extracting, based on a first pre-determined criterion and from a network traffic session exchanged during a protection phase between a server device and a client device of a network, a plurality of consecutive segments, wherein each of the plurality of consecutive segments comprises a sequence of consecutive packets exchanged between the server device and the client device;
• extracting, based on a second pre-determined criterion, a feature sequence from each of the plurality of consecutive segments, wherein the feature sequence comprises a sequence of feature vectors corresponding to and representing the sequence of consecutive packets, each feature vector corresponding-to-a packet in the sequence of consecutive packets and including:
• a packet direction, a packet payload length of a server transmitted packet, a packet payload length range of a client transmitted packet, packet flags, and a packet inter-arrival time;
• including the feature sequence in a plurality of protection phase feature sequences extracted from a first plurality of network traffic sessions exchanged during the protection phase between the server device and a first plurality of client devices of the network, wherein the plurality of protection phase feature sequences are extracted from the plurality of network traffic sessions based on the first pre-determined criterion and the second pre-determined criterion;
• comparing the plurality of protection phase feature sequences and a plurality of profiling phase feature sequences to generate a comparison result, wherein the plurality of profiling phase feature sequences were extracted from a second plurality of network traffic sessions exchanged during a profiling phase prior to the protection phase between the server device and a second plurality of client devices of the network, wherein generating a comparison result includes extracting, from the plurality of protection phase feature sequences, a set of suspicious feature sequences by excluding any feature sequence not found in the plurality of profiling phase feature sequences;
• and
• generating, in response to detecting a statistical measure of the comparison result exceeding a pre-determined threshold, an alert indicating the malicious network activity.