Upper-level protocol authentication

1. A method for processing communication traffic, comprising: monitoring the communication traffic that is sent over a network to a destination address; determining a baseline characteristic of the communication traffic while a DDoS attack is not in progress; detecting a deviation from the baseline characteristic that is indicative that at least some of the communication traffic has been sent by zombies having legitimate addresses on the network, wherein the deviation comprises at least one of a variation in a distribution of user agents specified in requests contained in the traffic, a variation in a distribution of source IP addresses, and a recurrence at regular intervals of a pattern of identical incoming data packets; and responsively to detecting the deviation, filtering the communication traffic so as to remove at least some of the communication traffic sent by the zombies, and to leave a first message in the communication traffic from a source computer sent from a source address that requests a first URI in accordance with a higher-level protocol; receiving the first message; sending a challenge to the source address of the first message in accordance with the higher-level protocol that directs the source computer to request a second URI in a second message; receiving the second message; verifying a presence of the second URI in the second message, responsively to verifying the presence of the second URI, accepting subsequent messages from the source address as legitimate.

2. The method according to claim 1 , wherein detecting the deviation further comprises detecting an increase in a number of different source addresses from which the communication traffic has originated.

3. The method according to claim 1 , wherein monitoring the communication traffic comprises reading contents of incoming data packets sent from the legitimate addresses on the network in accordance with a higher-level protocol, and wherein detecting the deviation comprises detecting a repeating pattern in the contents, wherein a plurality of the incoming data packets are identical and recur at regular intervals.

4. Apparatus for processing communication traffic, comprising: a network interface, which is arranged to communicate with a network; and a processor, which is coupled to the network interface and is arranged to monitor the communication traffic that is sent over the network to a destination address, to determine a baseline characteristic of the communication traffic while a DDoS attack is not in progress, to detect a deviation from the baseline characteristic that is indicative that at least some of the communication traffic has been sent by zombies having legitimate addresses on the network, and to filter the communication traffic responsively to detecting the deviation, so as to remove at least some of the communication traffic sent by the zombies, wherein the deviation comprises a variation in a distribution of user agents specified in HTTP requests, and to leave a first message in the communication traffic from a source computer sent from a source address that requests a first URI in accordance with a higher-level protocol, receive the first message, send a challenge to the source address of the first message in accordance with the higher-level protocol that directs the source computer to request a second URI in a second message, verify a presence of the second URI in the second message, and responsively to the presence of the second URI in the second message, to accept subsequent messages from the source address as legitimate.

5. The apparatus according to claim 4 , wherein the processor is arranged to detect an increase in a number of different source addresses from which the communication traffic has originated.

6. The apparatus according to claim 4 , wherein the processor is arranged to read contents of incoming data packets sent from the legitimate addresses on the network in accordance with a higher-level protocol and to detect a repeating pattern in the contents, wherein a plurality of the incoming data packets are identical and recur at regular intervals.

7. A computer software product for processing communication traffic, the product comprising a tangible computer-readable medium in which program instructions are stored, which instructions, when executed by one or more processors, cause the one or more processors to monitor the communication traffic that is sent over a network to a destination address, to determine a baseline characteristic of the communication traffic while a DDoS attack is not in progress, to detect a deviation from the baseline characteristic that is indicative that at least some of the communication traffic has been sent by zombies having legitimate addresses on the network, and to filter the communication traffic responsively to detecting the deviation, so as to remove at least some of the communication traffic sent by the zombies, wherein the deviation comprises a variation in a distribution of user agents specified in HTTP requests, and to leave a first message in the communication traffic from a source computer sent from a source address that requests a first URI in accordance with a higher-level protocol; receiving the first message, to send a challenge to the source address of the first message in accordance with the higher-level protocol that directs the source computer to request a second URI in a second message, to verify a presence of the second URI in the second message, and responsively to the presence of the second URI in the second message, to accept subsequent messages from the source address as legitimate.

8. The product according to claim 7 , wherein the instructions cause the one or more processors to detect an increase in a number of different source addresses from which the communication traffic has originated.

9. The product according to claim 7 , wherein the instructions cause the one or more processors to read contents of incoming data packets sent from the legitimate addresses on the network in accordance with a higher-level protocol and to detect a repeating pattern in the contents, wherein a plurality of the incoming data packets are identical and recur at regular intervals.

10. Apparatus for authenticating communication traffic, comprising: means for receiving a first message sent over a network from a source address, requesting information from a server in accordance with a higher-level protocol; means for sending a challenge to the source address in reply to the first message, in accordance with the higher-level protocol; means for receiving a second message from the source address following the challenge; and means for assessing legitimacy of the source address by determining whether the second message contains a correct response to the challenge, wherein the means for receiving a first message is operative to read contents of incoming data packets sent from legitimate addresses on the network in accordance with the higher-level protocol and to detect a repeating pattern in the contents, wherein a plurality of the incoming data packets are identical and recur at regular intervals, wherein responsively to a determination by the means for assessing legitimacy that assessment the second message contains the correct response to the challenge, the means for receiving a first message is operative to accept subsequent messages from the source address as legitimate.

11. The apparatus according to claim 10 , further comprising: means for monitoring the communication traffic; means for determining a baseline characteristic of the communication traffic while a DDoS attack is not in progress; means for detecting a deviation from the baseline characteristic that is indicative that at least some of the communication traffic has been sent by zombies having legitimate addresses on the network; and means for filtering the communication traffic responsively to detecting the deviation, so as to remove at least some of the communication traffic sent by the zombies, wherein the deviation comprises a variation in a distribution of user agents specified in HTTP requests.