METHOD OF PROTECTION AGAINST DDOS-ATTACK ON BASIS OF TRAFFIC CLASSIFICATION Russian patent published in 2019 - IPC H04L12/26 H04L12/853 

FIELD: physics.

SUBSTANCE: invention relates to the computer equipment. Method of protection against DDoS attacks based on traffic classification is disclosed, which includes the steps of: receiving packets or packet streams from external devices attempting to access protected devices in a secure network; classifying received packets, determining whether they relate to one or more of the many types of traffic; applying countermeasures depending on the result of the classification. At the stage of classification: forming probabilistic statistics separately on the values of parameters as address fields of data packet headers, as well as the values of the characteristics of load fields thereof, forming the values of the address informative features as packets of the variability of the values of the parameters of the address fields of the data packet headers; estimating for representative samples and memorizing for all given types of traffic frequencies (empirical probabilities) of all formed targeted informative features; forming the values of the load informative features by packet streams as functions of the variability of the parameter values of the load fields of data packet headers; estimating for representative samples and remember for all given types of traffic frequencies (empirical probabilities) of all generated informative load characteristics; forming the likelihood values of belonging sets of values of address and load informative features to a given type of traffic based on their estimated frequencies; registering the flow of traffic packets and producing the additions thereto successively, forming a sequence of sets of values of address and load informative features; assessing the likelihood values of belonging to a sequence of sets of values of address and load informative features to a given type of traffic; assessing the likelihood of attributing traffic to a given type of attack; making the selection of the minimum value of the number of observations that provide in advance the specified values of the detection errors of the 1^st and 2^nd kinds for all estimated likelihood ratios, varying the number of added traffic packets; estimating the posterior probabilities of the specified types of traffic for each received packet stream; at the stage of applying multiple countermeasures, for each received packet stream, the estimated a posteriori probabilities of the specified types of traffic are taken into account.

EFFECT: technical result is an extension of the functionality of methods for detecting DDoS attacks and countering them by providing the ability to detect network attacks of various types on the basis of joint consideration of probabilistic statistics, formed separately by the values of parameters of both the address fields of the data packet headers and the load fields.

4 cl, 5 dwg