Method and system to mitigate attacks distributed denial of service, based on the density estimate ip neighborhood.

摘要

Method of protecting computer systems from attacks over a network to which the computer system is connected, the method comprising the steps of: a. establishing, during attack-free operation of the computer system, a database as a source-IP-histogram storing all applications received from all senders of the computer system; b. calculating and storing a histogram smoothed-IP-histogram from the source-IP obtained in step a), the histogram representing the smoothed-IP probability of a particular sender of being a legitimate sender; c. applying a threshold on the smoothed-IP-histogram source differentiate between acceptable sender and sender to be rejected; d. monitoring requests to the computer system; and. accepting a new sender for which there was no entry in the source-IP-histogram before smoothing if the assumed probability value for the source address of the new sender derived from the smoothed-IP histogram exceeds the threshold.