Jeffrey A Lyon

US Patent:

20130291107, Oct 31, 2013

Filed:

Apr 27, 2012

Appl. No.:

13/458129

Inventors:

Shawn J. Marck - Los Angeles CA, US
Jeffrey A. Lyon - Norfolk VA, US
Robert C. Smith - Los Angeles CA, US

Assignee:

THE IRC COMPANY, INC. - Wilmington DE

International Classification:

G06F 21/00

US Classification:

726 23, 726 22

Abstract:

A method of mitigating an application distributed denial of service (DDoS) attack on a network includes receiving at an application DDoS mitigation appliance application layer logs, parsing the application layer logs into an application layer forensic file, comparing an entry of the application layer forensic file with a human behavior profile to determine a malicious qualifier associated with an application DDoS attack on the network, parsing the application layer log into a per-source forensic file, comparing an entry of the per-source forensic files with the malicious qualifier to determine a malicious Internet protocol (IP) addresses associated with the application DDoS attack, and providing the malicious IP address to a network device, wherein the network device drops network traffic associated with the application DDoS attack based upon the malicious IP address.