Techniques for automatically mitigating denial of service attacks via attack pattern matching

1. A method for mitigating a denial of service attack, the method comprising:

determining that a number of requests transmitted by a first client to a server during a first time period is greater than a first threshold;

in response, classifying the first client as a top talker;

generating one or more first attack patterns based on the requests transmitted by the first client to the server;

determining, at least partially in parallel with generating the one or more first attack patterns, that a number of requests transmitted by a second client to a server during a second time period is greater than the first threshold;

identifying additional requests being transmitted by at least one of the first client and the second client to the server;

determining that a number of the additional requests transmitted by the at least one of the first client and the second client to the server matches the one or more first attack patterns; and

in response, performing one or more operations to address the additional requests being transmitted to the server.

2. The method of claim 1 , the method further comprising:

blacklisting at least one of the first client and the second client for a predetermined time if the number of additional requests transmitted by the first client or the second client that matches the one or more first attack patterns is greater than a second threshold.

3. The method of claim 2 , the method further comprising:

determining, for the server, that a latency of processing queued requests exceeds a first limit.

4. The method of claim 3 , the method further comprising:

determining one or more additional attack patterns based on one or more of the queued requests.

5. The method of claim 3 , the method further comprising:

adjusting the first threshold and the second threshold in response to the determination that the latency of processing queued requests exceeds the first limit.

6. The method of claim 3 , the method further comprising:

determining, for the server, that the latency for processing queued requests falls below a second limit; and

ceasing any mitigation of the denial of service attack in response to the latency falling below the second limit.

7. The method of claim 3 , further comprising:

determining that the number of the additional requests transmitted by the first client to the server match one or more additional attack patterns; and

preventing one or more of the additional requests from being transmitted to the server if the number of additional requests that matches the one or more attack patterns is greater than the second threshold.

8. The method of claim 1 , further comprising:

generating, at least partially in parallel with performing the one or more operations, one or more second attack patterns based on the one or more additional requests transmitted by the second client to the server.

9. The method of claim 1 , further comprising:

determining, at least partially in parallel with performing the one or more operations, that a number of additional requests transmitted by a third client to the server during a third time period is greater than the first threshold.

10. A system for mitigating a denial of service attack, the system comprising:

at least one memory that includes instructions; and

a processor that is coupled to the memory, wherein, when the processor executes the instructions, the processor is configured to:

determine that a number of requests transmitted by a first client to a server during a first time period is greater than a first threshold;

in response, classify the first client as a top talker;

generate one or more first attack patterns based on the requests transmitted by the first client to the server;

determine, at least partially in parallel with generating the one or more first attack patterns, that a number of requests transmitted by a second client to a server during a second time period is greater than the first threshold;

identify additional requests being transmitted by at least one of the first client and the second client to the server;

determine that a number of the additional requests transmitted by the at least one of the first client and the second client to the server matches the one or more first attack patterns; and

in response, perform one or more operations to address the additional requests being transmitted to the server.

11. The system of claim 10 , wherein the processor is further configured to:

blacklist at least one of the first client and the second client for a predetermined time if the number of additional requests transmitted by the first client or the second client that matches the one or more first attack patterns is greater than a second threshold.

12. The system of claim 11 , wherein the processor is further configured to:

determine, for the server, that a latency of processing queued requests exceeds a first limit.

13. The system of claim 12 , wherein the processor is further configured to:

determine one or more additional attack patterns based on one or more of the queued requests.

14. The system of claim 12 , wherein the processor is further configured to:

adjust the first threshold and the second threshold in response to the determination that the latency of processing queued requests exceeds the first limit.

15. The system of claim 12 , wherein the processor is further configured to:

determine, for the server, that the latency for processing queued requests falls below a second limit; and

cease any mitigation of the denial of service attack in response to the latency falling below the second limit.

16. A non-transitory computer readable storage medium including instructions that, when executed by a processor, cause the processor to perform the steps of:

determining that a number of requests transmitted by a first client to a server during a first time period is greater than a first threshold;

in response, classifying the first client as a top talker;

generating one or more first attack patterns based on the requests transmitted by the first client to the server;

determining, at least partially in parallel with generating the one or more first attack patterns, that a number of requests transmitted by a second client to a server during a second time period is greater than the first threshold;

identifying additional requests being transmitted by at least one of the first client and the second client to the server;

determining that a number of the additional requests transmitted by the at least one of the first client and the second client to the server matches the one or more first attack patterns; and

in response, performing one or more operations to address the additional requests being transmitted to the server.

17. The non-transitory computer readable storage medium of claim 16 , further comprising:

blacklisting at least one of the first client and the second client for a predetermined time if the number of additional requests transmitted by the first client or the second client that matches the one or more first attack patterns is greater than a second threshold.

18. The non-transitory computer readable storage medium of claim 17 , further comprising:

determining, for the server, that a latency of processing queued requests exceeds a first limit.

19. The non-transitory computer readable storage medium of claim 18 , further comprising:

determining one or more additional attack patterns based on one or more of the queued requests.

20. The non-transitory computer readable storage medium of claim 18 , further comprising:

adjusting the first threshold and the second threshold in response to the determination that the latency of processing queued requests exceeds the first limit.

21. The non-transitory computer readable storage medium of claim 18 , further comprising:

determining, for the server, that the latency for processing queued requests falls below a second limit; and

ceasing any mitigation of the denial of service attack in response to the latency falling below the second limit.