Abstract: Methods and systems for detecting and mitigating high-rate Distributed Denial of Service (DDoS) attacks are herein described. The present invention contemplates a variety of improved techniques for using a flow-based statistical collection mechanism to monitor and detect deviations in server usage data. The method further includes combining multiple anomaly algorithms in a unique way to improve the accuracy of identifying a high-rate DDoS attack. The DDoS solution includes a two-phase approach of detection and mitigation, both of which operate on a local- and a global-basis. Moreover, the anomaly algorithms can be modified or extrapolated to obtain the traffic deviation parameters and therefore, the attack probabilities.

Abstract: Methods and systems for detecting and mitigating high-rate Distributed Denial of Service (DDoS) attacks are herein described. The present invention contemplates a variety of improved techniques for using a flow-based statistical collection mechanism to monitor and detect deviations in server usage data. The method further includes combining multiple anomaly algorithms in a unique way to improve the accuracy of identifying a high-rate DDoS attack. The DDoS solution includes a two-phase approach of detection and mitigation, both of which operate on a local- and a global-basis. Moreover, the anomaly algorithms can be modified or extrapolated to obtain the traffic deviation parameters and therefore, the attack probabilities.

Abstract: Methods and systems for detecting and mitigating high-rate Distributed Denial of Service (DDoS) attacks are herein described. The present invention contemplates a variety of improved techniques for using a flow-based statistical collection mechanism to monitor and detect deviations in server usage data. The method further includes combining multiple anomaly algorithms in a unique way to improve the accuracy of identifying a high-rate DDoS attack. The DDoS solution includes a two-phase approach of detection and mitigation, both of which operate on a local- and a global-basis. Moreover, the anomaly algorithms can be modified or extrapolated to obtain the traffic deviation parameters and therefore, the attack probabilities.

Abstract: A scheduler for controlling when entities are operated upon by the server. The scheduler includes N entities, where N is an integer greater than or equal to 2. Each entity has a rate at which it is to receive service from the server. The scheduler includes a memory having finishing times f.sub.i of the N entities, where f.sub.i corresponds to the time the i'th entity is to be operated upon by the server. The scheduler includes a virtual clock that keeps track of virtual time so the finishing times f.sub.i can be identified. The scheduler includes a controller which chooses entities to be operated upon by the server as a function of the finishing times. The controller slows virtual time to provide service to the entities. The controller is connected to the virtual clock and the memory. A scheduler for controlling when entities are operated upon the server. The scheduler includes N entities, where N is an integer greater than or equal to 2.