Effective control of communications traffic, even under fast-changing DDoS attacks, might be performed by (a) determining parameters of a
leaky bucket using nominal communications traffic, (b) applying current communications traffic to the
leaky bucket, (c) observing overflows, if any, of the
leaky bucket, (d) scoring the current traffic based on the observed overflows, and (e) passing or dropping traffic based on the
score. Alternatively, such control might be performed by (a) determining average mean and variance of each of one or more attribute values of nominal communications traffic, (b) determining a mean of each of the one or more attribute values of current communications traffic, (c) determining a probability that for each of the one or more attributes, its current mean value deviates more from its average mean that its current attribute value, (d) scoring the current traffic based on the determined probability or probabilities, and (e) passing or dropping traffic based on the
score.