MITIGATOR detects and automatically suppresses L3-L7 DDoS attacks. It contains more than 50 countermeasures based on challenge-response, rate-based, regexp, validation, limitation, iplist, application behavior.

MITIGATOR allows protection of TLS applications without traffic decryption. It does so via various methods of TLS and JA3 fingerprints analysis. In combination with other countermeasures and a web server log analyzer, it is possible to achieve maximum protection without traffic decryption. In addition, by using the HCA countermeasure, it is possible to authenticate senders using the challenge-response method within HTTPS.

MITIGATOR supports SYN-proxy (TCP Splicing) protection when the outgoing traffic from protected resources passes through it. If there is only incoming traffic, MITIGATOR uses the generally accepted checking methods of TCP session resetting and the wrong sequence number with different combinations of flags. In addition to the standard protection mechanisms, a unique mode of operation with ISN synchronization is available, in which asymmetric traffic protection does not require unnecessary packet exchange or disconnection with the client. It supports activation of host protection only for servers under attack, which negates the impact on the traffic of other services.

Detection of attacks and protection of individual policies does not require constant direction of traffic to MITIGATOR.

MITIGATOR contains countermeasures which can describe the typical traffic behavior of the protected protocol and set the sender authentication rules. In addition MITIGATOR team has developed a specialized user authentication protocol convenient for embedding in a protected application.