Abstract: Systems and methods for source-based misuse detection are provided. A system may store a managed objects in memory. Each of the managed objects corresponding to one or more computing devices configured to communicate over a communications network and having a configuration including one or more thresholds corresponding to network parameters for detecting an attack on the communications network. The system may monitor network traffic. The system may detect a first network parameter exceeds a threshold of a first misuse type. The system may identify a source internet protocol (IP) address associated with the first network parameter exceeding the threshold. The system may generate a tag for each source IP address indicating misuse of the communications network by the source IP address.

Abstract: A method for detecting the sources of distributed denial of service attacks is disclosed. Control plane signaling data and user plane data is collected using network monitoring equipment connected to a communications network. The control plane signaling data and user plane data is correlated. Amounts of traffic are calculated for individual computing devices based on the correlated data. One or more computing devices are determined based on the amounts of traffic associated with the one or more computing devices satisfying a device anomaly criterion. A record including a list of the one or more computing devices is generated.

Abstract: A method for detecting the sources of distributed denial of service attacks is disclosed. Control plane signaling data and user plane data is collected using network monitoring equipment connected to a communications network. The control plane signaling data and user plane data is correlated. Amounts of traffic are calculated for individual computing devices based on the correlated data. One or more computing devices are determined based on the amounts of traffic associated with the one or more computing devices satisfying a device anomaly criterion. A record including a list of the one or more computing devices is generated.