Application-level DDoS detection using service profiling

1. A method for detecting a malicious network activity, comprising:

extracting, based on a first pre-determined criterion and from a network traffic session exchanged during a protection phase between a server device and a client device of a network, a plurality of consecutive segments, wherein each of the plurality of consecutive segments comprises a sequence of consecutive packets exchanged between the server device and the client device;

extracting, based on a second pre-determined criterion, a feature sequence from each of the plurality of consecutive segments, wherein the feature sequence comprises a sequence of feature vectors corresponding to and representing the sequence of consecutive packets, each feature vector corresponding to a packet in the sequence of consecutive packets and including: a packet direction, a packet payload length of a server transmitted packet, a packet payload length range of a client transmitted packet, packet flags, and a packet inter-arrival time;

including the feature sequence in a plurality of protection phase feature sequences extracted from a first plurality of network traffic sessions exchanged during the protection phase between the server device and a first plurality of client devices of the network, wherein the plurality of protection phase feature sequences are extracted from the plurality of network traffic sessions based on the first pre-determined criterion and the second pre-determined criterion;

comparing the plurality of protection phase feature sequences and a plurality of profiling phase feature sequences to generate a comparison result, wherein the plurality of profiling phase feature sequences were extracted from a second plurality of network traffic sessions exchanged during a profiling phase prior to the protection phase between the server device and a second plurality of client devices of the network, wherein generating a comparison result includes extracting, from the plurality of protection phase feature sequences, a set of suspicious feature sequences by excluding any feature sequence not found in the plurality of profiling phase feature sequences; and

generating, in response to detecting a statistical measure of the comparison result exceeding a pre-determined threshold, an alert indicating the malicious network activity.

2. The method of claim 1 ,

wherein the plurality of consecutive segments are extracted from the network traffic session based on the first pre-determined criterion,

wherein the feature sequence is extracted from each of the plurality of consecutive segments based on the second pre-determined criterion.

3. The method of claim 2 ,

wherein the first pre-determined criterion comprises a first specification of a number of packets included in each of the plurality of consecutive segments, and

wherein the second pre-determined criterion comprises a second specification of a plurality of attributes extracted from each of the plurality of consecutive packets to form a corresponding feature vector.

4. The method of claim 3 ,

wherein the plurality of attributes represent at least one selected from a group consisting of a packet direction, a packet payload length of a server transmitted packet, a packet payload length range of a client transmitted packet, packet flags, and a packet inter-arrival time.

5. The method of claim 1 ,

wherein the statistical measure comprises a difference between a first number of occurrence of a particular feature sequence among the plurality of protection phase feature sequences and a second number of occurrence of the particular feature sequence among the plurality of profiling phase feature sequences.

6. The method of claim 5 ,

wherein the alert identifies the particular feature sequence.

7. The method of claim 1 ,

wherein the malicious network activity is known to be absent during the profiling phase.

8. A system for detecting a malicious network activity, comprising:

a processor and memory;

a feature sequence generator comprising instructions stored in the memory, when executed on the processor having functionality to:

extract, based on a first pre-determined criterion and from a network traffic session exchanged during a protection phase between a server device and a client device of a network, a plurality of consecutive segments, wherein each of the plurality of consecutive segments comprises a sequence of consecutive packets exchanged between the server device and the client device;

extract, based on a second pre-determined criterion, a feature sequence from each of the plurality of consecutive segments, wherein the feature sequence comprises a sequence of feature vectors corresponding to and representing the sequence of consecutive packets, each feature vector corresponding to a packet in the sequence of consecutive packets and including: a packet direction, a packet payload length of a server transmitted packet, a packet payload length range of a client transmitted packet, packet flags, and a packet inter-arrival time;

including the feature sequence in a plurality of protection phase feature sequences extracted from a first plurality of network traffic sessions exchanged during the protection phase between the server device and a first plurality of client devices of the network, wherein the plurality of protection phase feature sequences are extracted from the plurality of network traffic sessions based on the first pre-determined criterion and the second pre-determined criterion; and

extract a plurality of profiling phase feature sequences that were extracted from a second plurality of network traffic sessions exchanged during a profiling phase prior to the protection phase between the server device and a second plurality of client devices of the network;

a malicious activity detector comprising instructions stored in the memory, when executed on the processor having functionality to:

compare the plurality of protection phase feature sequences and the plurality of profiling phase feature sequences to generate a comparison result wherein generating a comparison result includes extracting, from the plurality of protection phase feature sequences, a set of suspicious feature sequences by excluding any feature sequence not found in the plurality of profiling phase feature sequences; and

generate, in response to detecting a statistical measure of the comparison result exceeding a pre-determined threshold, an alert indicating the malicious network activity; and

a repository for storing the plurality of profiling phase feature sequences, the plurality of protection phase feature sequences, and the plurality of suspicious feature sequences.

9. The system of claim 8 ,

wherein the plurality of consecutive segments are extracted from the network traffic session based on the first pre-determined criterion,

wherein the feature sequence is extracted from each of the plurality of consecutive segments based on the second pre-determined criterion.

10. The system of claim 9 ,

wherein the first pre-determined criterion comprises a first specification of a number of packets included in each of the plurality of consecutive segments, and

wherein the second pre-determined criterion comprises a second specification of a plurality of attributes extracted from each of the plurality of consecutive packets to form a corresponding feature vector.

11. The system of claim 10 ,

wherein the plurality of attributes represent at least one selected from a group consisting of a packet direction, a packet payload length of a server transmitted packet, a packet payload length range of a client transmitted packet, packet flags, and a packet inter-arrival time.

12. The system of claim 8 ,

wherein the statistical measure comprises a difference between a first number of occurrence of a particular feature sequence among the plurality of protection phase feature sequences and a second number of occurrence of the particular feature sequence among the plurality of profiling phase feature sequences.

13. The system of claim 12 , wherein the alert identifies the particular feature sequence.

14. The system of claim 8 , wherein the malicious network activity is known to be absent during the profiling phase.

15. A non-transitory computer readable medium embodying instructions for detecting a malicious network activity, the instructions when executed by a processor of a computer, comprising functionality for:

extracting, based on a first pre-determined criterion and from a network traffic session exchanged during a protection phase between a server device and a client device of a network, a plurality of consecutive segments, wherein each of the plurality of consecutive segments comprises a sequence of consecutive packets exchanged between the server device and the client device;

extracting, based on a second pre-determined criterion, a feature sequence from each of the plurality of consecutive segments, wherein the feature sequence comprises a sequence of feature vectors corresponding to and representing the sequence of consecutive packets, each feature vector corresponding-to-a packet in the sequence of consecutive packets and including: a packet direction, a packet payload length of a server transmitted packet, a packet payload length range of a client transmitted packet, packet flags, and a packet inter-arrival time;

including the feature sequence in a plurality of protection phase feature sequences extracted from a first plurality of network traffic sessions exchanged during the protection phase between the server device and a first plurality of client devices of the network, wherein the plurality of protection phase feature sequences are extracted from the plurality of network traffic sessions based on the first pre-determined criterion and the second pre-determined criterion;

comparing the plurality of protection phase feature sequences and a plurality of profiling phase feature sequences to generate a comparison result, wherein the plurality of profiling phase feature sequences were extracted from a second plurality of network traffic sessions exchanged during a profiling phase prior to the protection phase between the server device and a second plurality of client devices of the network, wherein generating a comparison result includes extracting, from the plurality of protection phase feature sequences, a set of suspicious feature sequences by excluding any feature sequence not found in the plurality of profiling phase feature sequences; and

generating, in response to detecting a statistical measure of the comparison result exceeding a pre-determined threshold, an alert indicating the malicious network activity.

16. The non-transitory computer readable medium of claim 15 ,

wherein the plurality of consecutive segments are extracted from the network traffic session based on the first pre-determined criterion,

wherein the feature sequence is extracted from each of the plurality of consecutive segments based on the second pre-determined criterion.

17. The non-transitory computer readable medium of claim 16 ,

wherein the first pre-determined criterion comprises a first specification of a number of packets included in each of the plurality of consecutive segments, and

wherein the second pre-determined criterion comprises a second specification of a plurality of attributes extracted from each of the plurality of consecutive packets to form a corresponding feature vector.

18. The non-transitory computer readable medium of claim 17 ,

wherein the plurality of attributes represent at least one selected from a group consisting of a packet direction, a packet payload length of a server transmitted packet, a packet payload length range of a client transmitted packet, packet flags, and a packet inter-arrival time.

19. The non-transitory computer readable medium of claim 15 ,

wherein the statistical measure comprises a difference between a first number of occurrence of a particular feature sequence among the plurality of protection phase feature sequences and a second number of occurrence of the particular feature sequence among the plurality of profiling phase feature sequences.

20. The non-transitory computer readable medium of claim 19 ,

wherein the alert identifies the particular feature sequence.