a system , method and computer program for detecting and restricting remotely controlled distributed denial of service software . this detection is based upon characteristic patterns seen in denial of service software . these patterns are monitored for at the generating source of the attack . when detected , the software application attempting a distributed denial of service is blocked from transmitting any packets to a target web server . therefore , this system , method a computer program stops distributed denial of service attacks before a web site can be overwhelmed by such an attack .