Dynamic detection of HTTP-based DDoS attacks using estimated cardinality

1. A computer method for detecting a Denial of Service (DoS) attack by detecting changes in recent cardinality of a network traffic flow, the method comprising:

receiving packets in a traffic flow;

performing cardinality estimation on the received packet traffic flow using a sliding HyperLogLog (HLL) process that determines a cardinality of defined classes of HTTP traffic at a prescribed time period regarding the received packet traffic flows;

maintaining a series of cardinalities for prior packet traffic flows;

detecting changes in cardinalities associated with prior packet traffic flows compared to determined cardinalities of a current packet traffic flow; and

determining an alert condition for the network traffic flow regarding a suspected DoS attack based upon the detected changes in cardinalities regarding comparison of the determined cardinalities associated with prior packet traffic flows compared to determined cardinalities of a current packet traffic flow and if a determined cardinality associated with packet traffic flows currently received is greater than a calculated geometric mean cardinality of past cardinality values by a prescribed ‘n’ geometric standard deviation of cardinalities.

2. The method of claim 1 , wherein the HLL process includes a sliding window process.

3. The method of claim 1 , wherein determining an alert condition further includes

causing a mitigation system operable to monitor received packets to enter a first state for determining a DoS attack when packet traffic flows currently received has determined cardinality values determined greater than a calculated geometric mean cardinality of past cardinality values by a ‘n’ geometric standard deviation of cardinalities.

4. The method of claim 3 , wherein determining an alert condition further includes:

determining if the determined cardinality values associated with packet traffic flows currently received is greater than a calculated geometric mean cardinality of past cardinality values by a ‘2n’ geometric standard deviation of cardinalities; and

causing the mitigation system to enter a second state operable to conduct predefined mitigation actions to prevent a DoS attack when packet traffic flows currently received is determined greater than a calculated geometric mean cardinality of past cardinality values by a prescribed ‘2n’ geometric standard deviation of cardinalities.

5. The method of claim 4 , wherein the mitigation actions to prevent a DoS attack includes at least one of: rate-limiting the traffic; discarding packets from the traffic; and

performing deep packet inspection (DPI) regarding the received packets.

6. The method of claim 1 wherein the Sliding HLL process determines a cardinality of defined classes of HTTP traffic at a prescribed time period regarding the received packet traffic flows.

7. A monitoring system for detecting a Denial of Service (DoS) attack by detecting changes in recent cardinality of a network traffic flow comprising:

a monitored network comprising a plurality of devices;

a storage repository for storing network traffic flow information; and

one or more network monitoring devices communicatively coupled to the monitored network and to the storage repository, wherein the one or more network monitoring devices are configured and operable to:

receive packets in a traffic flow;

perform cardinality estimation on the received packet traffic flow using a sliding HyperLogLog (HLL) process that determines a cardinality of defined classes of HTTP traffic at a prescribed time period regarding the received packet traffic flows;

maintain in the storage repository a series of cardinalities for prior packet traffic flows;

detect changes in cardinalities associated with prior packet traffic flows compared to determined cardinalities associated with a current packet traffic flow; and

determine an alert condition for the network traffic flow regarding a suspected DoS attack based upon the detected changes in cardinalities regarding comparison of the cardinalities associated with prior packet traffic flows compared to cardinalities of a current packet traffic flow and determining if a determined cardinality associated with packet traffic flows currently received is greater than a calculated geometric mean cardinality of past cardinality values by a prescribed ‘n’ geometric standard deviation of cardinalities.

8. The monitoring system of claim 7 , wherein the HLL process includes a sliding window process.

9. The monitoring system of claim 7 , wherein determining an alert condition further includes

cause a mitigation system operable to monitor received packets to enter a first state for determining a DoS attack when the determined cardinality values associated with packet traffic flows currently received is determined greater than the calculated geometric mean cardinality associated with previous received traffic flows by a prescribed ‘n’ geometric standard deviation of cardinalities.

10. The monitoring system of claim 9 , wherein determining an alert condition further includes:

determine if a determined cardinality values associated with packet traffic flows currently received is greater than a calculated geometric mean cardinality of past cardinality values by a ‘2n’ geometric standard deviation of cardinalities; and

cause the mitigation system to enter a second state operable to conduct predefined mitigation actions to prevent a DoS attack when the cardinality values associated with packet traffic flows currently received is determined greater than the calculated geometric mean cardinality of past cardinality values by a ‘2n’ geometric standard deviation of cardinalities.

11. The monitor system of claim 9 , wherein the mitigation actions to prevent a denial of service attack consist of: rate-limiting the traffic; discarding packets from the traffic;

and performing deep packet inspection (DPI) on all or a subset of packets in the received traffic.