Abstract: A DNS server DDoS attack mitigation system is provided, comprising a DNS cache module. A DNS query or UDP data packet from an originating source intended for a DNS server is to be diverted to the DNS cache module. The DNS cache module validates the DNS query or UDP data packet and discard it if it is malformed. The DNS cache module then extracts from the DNS query or UDP data packet a domain name and virtual IP address (VIP) of the requested destination resource, and source IP (SIP). Using the domain name, VIP, and SIP to find and retrieve from its cache the matching DNS record and respond with a response message according the matched DNS record type. If a match is not found, the DNS query or UDP data packet is dropped, dropped and responded to with a customizable message, or forwarded to the DNS server.

Abstract: A DDoS attack mitigation system implemented by a DDoS attack mitigation central processing server configured to execute server-side machine instructions and a mobile communication device configured to execute device-side machine instructions. The server-side machine instructions include: a reverse proxy traffic handler and a user-interactive DDoS attack mitigation scheme handler for issuing DDoS attack mitigation challenges and authenticating the users' authenticating actions. The device-side machine instructions are encapsulated in a SDK which includes a user-interactive DDoS attack mitigation scheme, and a set of APIs to facilitate the invocation calls from the mobile app integrating the DDoS attack mitigation system. The user-interactive DDoS attack mitigation scheme is a gesture-based CAPTCHA with a GUI suitable to be displayed on the mobile communication device's touch screen and accepts touch input.

Abstract: A DDoS attack mitigation process, comprising: receiving a request from a client device; computing a data access frequency for the client device, data access frequency being a number of requests received from the client device within a set period of time; comparing the data access frequency to a threshold value, wherein a DDoS attack is suspected if the data access frequency is higher than the threshold value; if a DDoS attack is not suspected, then the request being forwarded to the intended resource; else if a DDoS attack is suspected, then responding to the client user's device with a DDoS attack mitigation challenge webpage embedded with a user-interactive widget to the client user's device requiring the client device's user to drag a prompt icon along a movement path without interrupt for authentication.