Network attack mitigation based on distributed packet analysis
Localized and global detection and mitigation of network attacks in a distributed platform are provided. The localized detection identifies attacks occurring at individual nodes of the distributed platform based on packet analysis conducted by each individual node. The global detection identifies attacks occurring across the distributed platform based on packet analysis conducted on traffic aggregated from across the distributed platform. Either detection involves inspecting headers of the sampled packets. Each header property is scored based on an amount of deviation from threshold values. The sum of scores identifies the header properties that form an attack signature. Attack protections are implemented against subsequently arriving packets with header properties matching the attack signature.
1. A method for automated network attack detection and mitigation, the method comprising:
sampling a header from a plurality of packets that are provided by a particular sender or that are directed to common content, wherein each header comprises a plurality of properties;
scoring a first property of the plurality of properties from the header of the plurality of packets based on the first property changing in each packet of the plurality of packets and an amount of deviation between a value set for the first property and an expected constant value;
scoring a different second property of the plurality of properties from the header of the plurality of packets based the second property remaining constant in each packet of the plurality of packets;
detecting an attack in response to a total score, resulting from said scoring of the first property and said scoring of the second property, exceeding a score threshold;
defining an attack signature for the attack based on at least the first property and the second property of the header;
implementing an attack protection against a subsequently arriving set of packets in response to detecting the attack signature in the header of the set of packets.
2. The method of claim 1 further comprising distributing the attack protection and the attack signature to a plurality of other servers operating in a same distributed platform, wherein the plurality of other servers implement said attack protection in response to said distributing.
3. The method of claim 1 , wherein implementing the attack protection comprises dropping the set of packets.
4. The method of claim 1 further comprising forwarding the header of each packet from the plurality of packets to a different second server.
5. The method of claim 4 further comprising detecting a different second attack signature at the second server based on headers of the plurality of packets and headers of a second plurality of packets sampled and forwarded from a different third.
6. The method of claim 1 further comprising storing each header of the plurality of packets.
7. A method for protecting a plurality of nodes of a distributed platform from a network attack, the method comprising:
receiving a plurality of packets at the plurality of nodes of the distributed platform;
providing a sampling of the plurality of packets from the plurality of nodes to a back-office server of the distributed platform, wherein said sampling comprises a subset of the plurality of packets;
scoring two or more header properties of the subset of packets based on an amount of deviation between a set value for each property and an expected value that is derived from a prior set value for each property in at least one prior packet originating from a common sender or one prior packet for common content, wherein said scoring comprises adjusting a score of a first property of the two or more header properties based on an amount of deviation between the set value of the first property and the expected value for the first property corresponding to a constant value;
selecting an attack protection from at least a less restrictive first attack protection and a more restrictive second attack protection based on said scoring, wherein said selecting comprises selecting the first attack protection in response to a first value resulting from said scoring of the two or more header properties being less than a threshold, and selecting the second attack protection in response to a second value resulting from said scoring of the two or more header properties being greater than the threshold; and
propagating the attack protection from the back-office server to the plurality of nodes.
8. The method of claim 7 further comprising implementing said attack protection at each node of the plurality of nodes in response to said propagating.
9. The method of claim 7 further comprising detecting an attack signature for the attack protection by identifying one or more properties from headers of the subset of packets with an anomalous value deviating from corresponding threshold values set for the one or more properties.
10. The method of claim 9 , wherein said detecting further comprises defining the attack signature based on said one or more properties and said anomalous value.
11. The method of claim 9 , wherein said detecting further comprises identifying a set of senders originating said one or more properties with the anomalous value, and defining the attack signature in protecting against packets from said set of senders.
12. The method of claim 10 further comprising detecting at a particular node of the plurality of nodes, an attack signature from inspecting headers of a particular set of the plurality of packets sampled by the particular node.
13. The method of claim 12 further comprising implementing at the particular node, the attack protection received from said propagating and a different second attack protection triggering in response to packets arriving at the particular node with headers matching the attack signature.
14. A method comprising:
receiving a plurality of packets sent by a plurality of clients to a particular server;
sampling the plurality of packets at the particular server, wherein said sampling comprises extracting at least two packets sent from a particular client of the plurality of clients;
computing a first score for a first header property of the at least two packets based on a difference between a value set for the first header property in the at least two packets and an expected constant value defined for the first header property;
computing a second score for a different second header property of the at least two packets based on a difference between a value set for the second header property in the at least two packets and an expected changing value defined for the second header property;
defining an attack signature based on the first header property and the second header property in response to detecting values deviating from one another instead of remaining the expected constant value in the first header property of the at least two packets, and in response to the first score and the second score, that are computed for the first header property and the second header property of the at least two packets from the particular client, exceeding a threshold; and
invoking an attack protection at the particular server in response to receiving subsequent packets matching the attack signature, wherein said subsequent packets match the attack signature based on an anomalous value being set for one or more of the first header property and the second header property.
15. The method of claim 14 , wherein said defining the attack signature is further in response to detecting a fixed static value instead of the expected changing value in the second header property of the at least two packets.
16. The method of claim 14 , wherein said defining comprises comparing header properties of the at least two packets from the particular client.