Denial of service attack mitigation based on compute node failures
Denial of service attack mitigation based on compute node failures is described herein. In an example, a system can include a first point of presence (POP) that is located in a first region and a server that is located in a second region. The system can also include a first compute node that is located in the first region and communicatively coupled with the first POP or that is located in the second region and communicatively coupled with the server and has a smaller capacity to handle requests than each of the POP and the server. The first compute node is configured to receive a request of the POP indicating a network address of the server, determine data to send the request along a network path to the server, and send the request along the network path based on the data.
1 . A system comprising:
an origin server located in a first region and configured to host a web site;
a first compute node located in the first region and communicatively coupled with the origin server;
a second compute node located in a second region and communicatively coupled with the first compute node; and
a first content data network (CDN) point of presence (POP) located in the second region, communicatively coupled with the second compute node, and configured to indicate a first internet protocol (IP) address of the origin server,
wherein the second compute node is configured to:
receive, from the first CDN POP, a plurality of web requests corresponding to a distributed denial-of-service (DDoS) attack, the plurality of web requests associated with a client signature and requesting the web site based at least in part on the first IP address;
determine, based at least in part on the plurality of web requests sharing the client signature, to send the plurality of web requests to the first computing node instead of the origin server, wherein the first compute node has a smaller processing capacity than the origin server and is configured to not automatically scale in response to exceeding the smaller processing capacity; and
send the plurality of web requests to the first compute node instead of origin server, thereby causing the first compute node to fail such that the DDoS attack fails to reach the web site.
2 . The system of claim 1 , further comprising:
a third compute node located in the second region, communicatively coupled with the first compute node, and isolated from the second compute node; and
a second CDN POP located in the second region, communicatively coupled with the third compute node, and configured to indicate the first IP address or a second IP address of the origin server, wherein:
the third compute node has a smaller processing capacity than the second CDN POP,
the third compute node is configured to receive, from the second CDN POP, web requests requesting the web site based at least in part on the first IP address or the second IP address, and
the third compute node is further configured to fail sending the web requests based at least in part on the smaller processing capacity of the third compute node being insufficient to handle the web requests.
3 . The system of claim 1 , further comprising:
a third compute node located in the first region, communicatively coupled with the origin server and with a plurality of compute nodes in the second region, and isolated from the first compute node, wherein:
the third compute node has a smaller processing capacity than the origin server,
the third compute node is configured to receive web requests each sent from one of the plurality of compute nodes, and
the third compute node is further configured to fail sending the web requests to the origin server based at least in part on the smaller processing capacity of the third compute node being insufficient to handle the web requests.
4 . The system of claim 1 , wherein a first web request of the plurality of web requests is sent from the second compute node to the first compute node based at least in part on data that associates a set of characteristics of the first web request with an identifier of the first compute node.
5 . A computer-implemented method comprising:
receiving, by a first compute node located in a first region, first requests indicating a first network address of a first server that is located in the first region or a second region and corresponding to a distributed denial-of-service (DDoS) attack;
determining, based at least in part on the first requests sharing a client signature, to send the first requests to a second computing node instead of the first server, wherein the second compute node has a smaller processing capacity than the first server and is configured to not automatically scale in response to exceeding the smaller processing capacity; and
sending, by the first compute node, the first requests to the second computing node instead of the first server, thereby causing the second computing node to fail such that the DDoS attack fails to reach the first server.
6 . The computer-implemented method of claim 5 , further comprising:
determining that a second request is to be sent to a third compute node that is located in the second region, is communicatively coupled with the first server that is located in the second region, and has a smaller capacity to handle requests than the first server, and wherein the second request is sent from the first compute node to the third compute node.
7 . The computer-implemented method of claim 5 , further comprising:
determining a second request is to be sent to the first server, wherein the second request is received from a third compute node that is located in the second region, wherein the first server is located in the first region, and wherein the second request is sent from the first compute node to the first server.
8 . The computer-implemented method of claim 5 , wherein the second compute node is located in the first region and the first server is located in the second region, wherein the first compute node and the second compute node are communicatively coupled with a point of presence (POP) located in the first region, wherein the first requests are sent from the POP to the first compute node and second requests are sent from the POP to the second compute node, and wherein the first compute node and the second compute node are communicatively coupled to a third compute node located in the second region and has a third smaller capacity to handle requests than the first server.
9 . The computer-implemented method of claim 5 , further comprising:
determining a set of characteristics of a second request;
determining, based at least in part on the set of characteristics, an identifier of a third compute node; and
sending, based at least in part on the identifier, the second request to the third compute node, wherein the third compute node is located in the second region and is communicatively coupled with the first server.
10 . The computer-implemented method of claim 5 , further comprising:
sending a second request to a third compute node based at least in part on a hash of the second request, and wherein the third compute node is located in the second region, is communicatively coupled with the first server, and has a capacity that is based at least in part on a number of requests that are associated with the hash.
11 . The computer-implemented method of claim 5 , further comprising:
determining, by the first compute node based at least in part on a second request, a set of characteristics of the second request; and
sending, by the first compute node, the second request to a database, wherein the database is configured to:
store a mapping that associates a set of characteristics of the second request and an identifier of a third compute node;
determine the set of characteristics based at least in part on the second request;
determine, based at least in part on the mapping, the identifier of the third compute node; and
send, based at least in part on the identifier, the second request to the third compute node, and wherein the third compute node is located in the second region and is communicatively coupled with the first server.
12 . The computer-implemented method of claim 5 , further comprising:
receiving, by the second compute node, second requests indicating the first network address within a time unit, wherein the second compute node is configured to fail sending the second requests to the first server based at least in part on the smaller capacity being insufficient to handle the second requests.
13 . A system comprising:
a first point of presence (POP) that is located in a first region;
a first server that is located in a second region; and
a first compute node that is located in the first region and communicatively coupled with the first POP or that is located in the second region and communicatively coupled with the first server, has a smaller capacity to handle requests than each of the first POP and the first server, and is configured to:
receive first requests of the first POP, the first requests indicating a first network address of the first server and corresponding to a distributed denial-of-service (DDoS) attack;
determine, based at least in part on the first requests sharing a client signature, to send the first requests to a second computing node instead of the first server, wherein the second compute node has a smaller processing capacity than the first server and is configured to not automatically scale in response to exceeding the smaller processing capacity; and
send the first requests to the second computing node instead of the first server, thereby causing the second compute node to fail such that the DDos attack fails to reach the first server.
14 . The system of claim 13 , further comprising:
a second POP that is located in the first region or a third region; and
the second compute node that is co-located with the second POP, is communicatively coupled with the second POP, and has a smaller capacity to handle second requests of the second POP than the second POP, wherein the first compute node is co-located with the first POP and is isolated from the second compute node and the second POP.
15 . The system of claim 13 , further comprising:
the second compute node that is co-located with the first POP, communicatively coupled with the first POP, and isolated from the first compute node, wherein the first POP is configured to send the first requests for a first web site to the first compute node and second requests for a second web site to the second compute node, and wherein the second compute node has a smaller capacity to handle the second requests than the first POP.
16 . The system of claim 13 , further comprising:
a second server that is located in the second region;
the second compute node that is located in the first region and communicatively coupled with the first POP or that is located in the second region and communicatively coupled with the second server, has a smaller capacity to handle second requests than each of the first POP and the second server, and is configured to:
receive a second request of the first POP, the second request indicating a second network address of the second server; and
send the second request along a second network path to the second server.
17 . The system of claim 13 , further comprising:
a second server that is located in the second region, wherein the first compute node is further configured to:
receive a second request of the first POP, the second request indicating a second network address of the second server; and
send the second request to the second server.
18 . The system of claim 13 , wherein the smaller capacity is defined based at least in part on first expected requests of the first POP during a time interval or second expected requests destined to the first server during the time interval.
19 . The system of claim 13 , wherein the system is configured to store a mapping, and wherein the mapping further associates multiple sets of request characteristics to an identifier of the second compute node.
20 . The system of claim 19 , wherein the system is configured to:
determine a set of characteristics of a first request of the first requests;
determine, based at least in part on the mapping and the set of characteristics, an identifier of the second compute node; and
send, based at least in part on the identifier, the first request to the second compute node.