System and method for iteratively updating network attack mitigation countermeasures

1. A computer-implemented method to mitigate a malicious network attack, the method comprising:

receiving an attack alert that a network attack has been detected;

saving a sample of captured network traffic in response to the attack alert;

playing back the sample while applying a playback countermeasure to the captured network traffic to block sample segments from the sample;

analyzing at least one of the blocked sample segments and throughput sample segments that are not blocked; and

adjusting the playback countermeasure in response to a result of the analyzing.

2. The method of claim 1 , further comprising applying the adjusted playback countermeasure as mitigation countermeasures to network traffic in real-time.

3. The method of claim 1 , wherein the attack alert is received in real-time.

4. The method of claim 1 , further comprising requesting capture of the sample in response to the attack alert.

5. The method of claim 1 , wherein the network attack is a DDOS attack.

6. The method of claim 1 , wherein the playback countermeasure includes at least one filter, and adjusting the playback countermeasure includes at least one of adding and removing an element of the filter that blocks traffic.

7. The method of claim 1 , further comprising:

monitoring the network traffic in real-time to detect an attack; and

sending the attack alert in real-time in response to detection of an attack.

8. The method of claim 1 , wherein analyzing the removed packets includes detecting tagged packets, the tagged packets being tagged to indicate that the packet has characteristics verified as being at least one of legitimate network traffic and attack network traffic.

9. The method of claim 8 , further comprising:

accessing a whitelist that includes one or more entries that are verified as being associated with legitimate network traffic;

receiving updates to the whitelist in real time; and

tagging packets of the sample that match any of the entries in the whitelist.

10. A computer system for mitigating a malicious network attack, comprising:

a memory configured to store instructions;

a processor disposed in communication with said memory, wherein said processor upon execution of the instructions is configured to:

receive an attack alert that a network attack has been detected;

save a sample of captured network traffic in response to the attack alert;

play back the sample while applying a playback countermeasure to the captured network traffic to block sample segments from the sample;

analyze at least one of the blocked sample segments and throughput sample segments that are not blocked; and

adjust the playback countermeasure in response to a result of the analyzing.

11. The computer system of claim 10 , wherein the processor, upon execution of the instructions, is further configured to apply the adjusted playback countermeasure as mitigation countermeasures to network traffic in real-time.

12. The computer system of claim 10 , wherein the attack alert is received in real-time.

13. The computer system of claim 10 , wherein the processor, upon execution of the instructions, is further configured to request capture of the sample in response to the attack alert.

14. The computer system of claim 10 , wherein the playback countermeasure includes at least one filter, and adjusting the playback countermeasure includes at least one of adding and removing an element of the filter that blocks traffic.

15. The computer system of claim 10 , wherein the processor, upon execution of the instructions, is further configured to:

monitor the network traffic in real-time to detect an attack; and

send the attack alert in real-time in response to detection of an attack.

16. The computer system of claim 10 , wherein analyzing the removed packets includes detecting tagged packets, the tagged packets being tagged to indicate that the packet has characteristics verified as being at least one of legitimate network traffic and attack network traffic.

17. The computer system of claim 10 , wherein the processor, upon execution of the instructions, is further configured to:

access a whitelist that includes one or more entries that are verified as being associated with legitimate network traffic;

receive updates to the whitelist in real time; and

tag packets of the sample that match any of the entries in the whitelist.

18. A non-transitory computer readable storage medium and one or more computer programs embedded therein, the computer programs comprising instructions, which when executed by a computer system, cause the computer system to:

receive an attack alert that a network attack has been detected;

save a sample of captured network traffic in response to the attack alert;

play back the sample while applying a playback countermeasure to the captured network traffic to block sample segments from the sample;

analyze at least one of the blocked sample segments and throughput sample segments that are not blocked; and

adjust the playback countermeasure in response to a result of the analyzing.

19. The computer readable storage medium of claim 18 , wherein the computer system, when executing the computer programs, is caused to apply the adjusted playback countermeasure as mitigation countermeasures to network traffic in real-time.

20. The computer readable storage medium of claim 18 , wherein the computer system, when executing the computer programs, is caused to:

access a whitelist that includes one or more entries that are verified as being associated with legitimate network traffic;

receive updates to the whitelist in real time; and

tag packets of the sample that match any of the entries in the whitelist.