Network Overload Detection and Mitigation System and Method

Abstract

Systems and methods are provided for detecting and mitigating overload conditions affecting one or more computers attached to a network, such as overloads resulting from distributed denial of service (DDoS) attacks, for example. According to some described embodiments, an attempted overload condition is detected, e.g., by a system, through following a method, or both, within a data cleaning center. Detection may be achieved, e.g., by analyzing data packets traveling over the network to identify packets that bear characteristics that may be associated with DDoS attacks, and this analysis may include examination of the packets' data payloads. Mitigation, in turn, may include discarding some data packets, redirecting network traffic, or some combination thereof.

1 . A system for detecting and mitigating an attempted overload condition targeting a domain name server, comprising:
 a network connection for receiving a plurality of DNS requests from one or more client computers located on a network, the plurality of DNS requests directed to a DNS server; and   a processor for providing a response to the plurality of DNS requests to the one or more client computers, instead of the DNS server, if the processor detects that a threshold number of the plurality of DNS requests received over a time period are substantially duplicate.