Detecting patterns in network traffic responses for mitigating ddos attacks

Abstract

A computer system and process for mitigating a Distributed Denial of Service (DDoS) attack to one or more protected computer networks by determining keywords and/or patterns in HyperText Transfer Protocol (HTTP) responses. Stored HTTP responses are analyzed to extract one or more HTTP characteristics for each stored HTTP response. One or more patterns having one or more keywords in each stored HTTP response is determined utilizing the extracted one or more HTTP characteristics for each stored HTTP response. A hash value is determined for each determined pattern, which is preferably stored in a hash structure accompanied by its respective determined HTTP characteristics. Each hash value accompanied by its respective determined HTTP characteristics is stored as a mitigation filter candidate if the hash value contains a determined pattern consisting of at least a predetermined percentage of all determined patterns stored in the hash structure. A determination is then made as to whether if each stored filter candidate contains an acceptable pattern, whereby filter candidates having acceptable patterns are removed from being a mitigation filter candidate. A regular expression is then generated for each stored filter candidate adaptable to be utilized as keywords in a DDOS mitigation filter.