Methods and systems for detecting denial of service attacks on a network

1 . A computer-implemented method for detecting a Denial-of-Service (DoS) attack on a network, the computer-implemented method comprising:

sampling a traffic carried by the network between data processing devices, the traffic comprising data packets transmitted between the data processing devices;

determining statistically estimated features based on the sampled traffic;

executing a first heuristic algorithm based on the statistically estimated features, the first heuristic algorithm being configured to generate a confidence score indicative of a probability that at least some of the data packets constitute a DoS attack;

comparing the confidence score with a first confidence threshold to determine whether a mitigation order is to be generated;

comparing the confidence score with a second confidence threshold to determine whether to generate an instruction granting access to the network; and

after determining that the confidence score is between the first confidence threshold and the second confidence threshold:

storing information about an output of the first heuristic algorithm,

collecting additional samples of the traffic,

determining additional statistically estimated features,

executing the first heuristic algorithm or a second heuristic algorithm based on the additional statistically estimated features, and

updating the confidence score based on an output of the first heuristic algorithm or the second heuristic algorithm.

2 . The computer-implemented method of claim 1 , wherein the traffic is continuously sampled.

3 . The computer-implemented method of claim 2 , wherein the statistically estimated features are periodically updated based on samples of the traffic collected during a duration of a pre-determined period of time.

4 . The computer-implemented method of claim 1 , wherein the statistically estimated features are determined based on the sampling of the traffic being sampled during a duration of a pre-determined time span.

5 . The computer-implemented method of claim 1 , wherein the first heuristic algorithm receives the statistically estimated features as an input, and wherein the second heuristic algorithm receives an output of the first heuristic algorithm as an input.

6 . The computer-implemented method of claim 5 , wherein:

the first heuristic algorithm is configured to extract curated statistically estimated features from the statistically estimated features; and

the second heuristic algorithm is configured to generate a confidence score based on the curated statistically estimated features.

7 . The computer-implemented method of claim 1 , wherein a given statistically estimated feature is a number of data packets transmitted or received by the data processing devices.

8 . The computer-implemented method of claim 1 , wherein a given statistically estimated feature is a number of data bytes transmitted or received by the data processing devices.

9 . The computer-implemented method of claim 1 , wherein sampling the traffic comprises determining a sampling rate for sampling the traffic.

10 . The computer-implemented method of claim 9 , wherein the sampling rate is based on at least one of a rate of the traffic or a pre-determined confidence interval to detect the DoS attack.

11 . The computer-implemented method of claim 1 , wherein the statistically estimated features comprise information about at least one of:

source IP addresses of data processing devices that emitted the data packets,

source ports of the data processing devices that emitted the data packets,

destination IP addresses of data processing devices that emitted the data packets,

destination ports of the data processing devices that emitted the data packets, or

protocols used for communication between the data processing devices.

12 . A system for detecting a Denial-of-Service (DoS) attack on a network, the system comprising at least one processor and memory storing a plurality of executable instructions which, when executed by the at least one processor, cause the system to:

sample a traffic carried by the network between data processing devices, the traffic comprising data packets transmitted between the data processing devices;

determine statistically estimated features based on the sampled traffic;

execute a first heuristic algorithm based on the statistically estimated features, the first heuristic algorithm being configured to generate a confidence score indicative of a probability that at least some of the data packets constitute a DoS attack;

compare the confidence score with a first confidence threshold to determine whether a mitigation order is to be generated;

compare the confidence score with a second confidence threshold to determine whether to generate an instruction granting access to the network; and

after determining that the confidence score is between the first confidence threshold and the second confidence threshold:

store information about an output of the first heuristic algorithm,

collect additional samples of the traffic,

determine additional statistically estimated features,

execute the first heuristic algorithm or a second heuristic algorithm based on the additional statistically estimated features, and

update the confidence score based on an output of the first heuristic algorithm or the second heuristic algorithm.

13 . The system of claim 12 , wherein the executable instructions cause the system to continuously sample the traffic.

14 . The system of claim 13 , wherein the executable instructions cause the system to periodically update the statistically estimated features based on samples of the traffic collected during a duration of a pre-determined period of time.

15 . The system of claim 12 , wherein the executable instructions cause the system to estimate the statistically estimated features based on the sampling of the traffic being sampled during a duration of a pre-determined time span.

16 . A non-transitory computer-readable medium comprising computer-readable instructions that, upon being executed by at least one processor, cause the at least one processor to:

sample a traffic carried by a network between data processing devices, the traffic comprising data packets transmitted between the data processing devices;

determine statistically estimated features based on the sampled traffic;

execute a first heuristic algorithm based on the statistically estimated features, the first heuristic algorithm being configured to generate a confidence score indicative of a probability that at least some of the data packets constitute a DoS attack; and

compare the confidence score with a first confidence threshold to determine whether a mitigation order is to be generated;

compare the confidence score with a second confidence threshold to determine whether to generate an instruction granting access to the network;

after determining that the confidence score is between the first confidence threshold and the second confidence threshold:

store information about an output of the first heuristic algorithm,

collect additional samples of the traffic,

determine additional statistically estimated features,

execute the first heuristic algorithm or a second heuristic algorithm based on the additional statistically estimated features, and

update the confidence score based on an output of the first heuristic algorithm or the second heuristic algorithm.