SYSTEM AND METHODS FOR CLASSIFYING INTERNET DEVICES AS HOSTILE OR BENIGN

Systems and methods for classification of internet devices for classifying devices on the Internet as either hostile or benign. Hostile devices are those that are or will be engaging in denial of service attacks. The systems and methods for classification of internet devices as hostile or benign generally include 1) a proof-of-work protocol, 2) a method for adjusting a device's ‘attacker score’ based on its protocol behavior, 3) a method for detecting tampering of puzzle parameters, 4) a method for limiting request rates of both benign and hostile devices, 5) a method for collecting device fingerprints and their associated status from a high-speed memory cache and persisting them to a database, 6) a web services deployment model to provide device classification services to third parties, and 7) a method for dissemination of device blacklists and whitelists to all subscribers of the web service 8) a deployment model of the attacker identification system as a request filter at the front-end of a distributed web services system, and 9) a management server for control of the system parameters to enable various modes of classification and device request rate limiting.