CPC H04L 63/1458 (2013.01) [H04L 63/0209 (2013.01); H04L 63/101 (2013.01); H04L 63/1416 (2013.01); H04L 63/1425 (2013.01); H04L 63/20 (2013.01); H04L 67/02 (2013.01); H04L 2463/141 (2013.01)] | 22 Claims |
1. A method for protecting cloud-hosted applications against application-layer slow distributed denial-of-service (DDoS) attacks, comprising:
collecting telemetries from a plurality of sources deployed in a plurality of public cloud computing platforms, wherein each of the plurality of public cloud computing platforms hosts an instance of a protected cloud-hosted application, wherein the telemetries are collected out-of-path of traffic to and from each instance of the protected cloud-hosted application;
providing a set of rate-based and rate-invariant features based on the collected telemetries;
evaluating each feature in the set of rate-based and rate-invariant features to determine whether a behavior of each feature and a behavior of the set of rate-based and rate-invariant features indicate a potential application-layer slow DDoS attack; and
causing execution of a mitigation action, when an indication of a potential application-layer slow DDoS attack is determined.
|