Tracing mechanism for monitoring and analysis of cloud-based communication session attacks
A tracing mechanism is provided for analyzing session-based attacks. An exemplary method comprises: detecting a potential attack associated with a session from a potential attacker based on predefined anomaly detection criteria; adding a tracing flag identifier to a response packet; sending a notification to a cloud provider of the potential attack, wherein the notification comprises the tracing flag identifier; and sending the response packet to the potential attacker, wherein, in response to receiving the response packet with the tracing flag identifier, the cloud provider: determines a source of the potential attack based on a destination of the response packet; forwards the response packet to the potential attacker based on the destination of the response packet; and monitors the determined source to evaluate the potential attack. The response packet is optionally delayed by a predefined time duration and/or until the cloud provider has acknowledged receipt of the notification.
1. A method, comprising:
detecting a potential attack associated with a session from a potential attacker based on one or more predefined anomaly detection criteria;
adding, using at least one processing device, a tracing flag identifier to at least one response packet;
sending, using the at least one processing device, a notification to at least one cloud provider of the potential attack, wherein the notification comprises the tracing flag identifier; and
sending the at least one response packet to the potential attacker,
wherein, in response to receiving the at least one response packet with said tracing flag identifier, the at least one cloud provider performs the following steps:
determine a source of the potential attack based on a destination of the at least one response packet;
forward the at least one response packet to the potential attacker based on the destination of the at least one response packet; and
monitor the determined source to evaluate the potential attack.
2. The method of claim 1 , further comprising the step of identifying a potential source of the potential attack using a list of suspected Internet Protocol addresses.
3. The method of claim 1 , further comprising the step of identifying one or more cloud providers associated with the potential attack based on an originating Internet Protocol address of the session.
4. The method of claim 1 , wherein the step of sending the at least one response packet to the potential attacker is delayed one or more of by a predefined time duration and until said at least one cloud provider has acknowledged receipt of the notification.
5. The method of claim 1 , wherein the notification is sent to the at least one cloud provider using an application programming interface.
6. The method of claim 1 , wherein the tracing flag identifier comprises one or more of a value placed in one or more fields of a header of the at least one response packet to the potential attacker, a value that encapsulates a response, a value generated by the at least one processing device and the at least one cloud provider based on a number generator seed, and a satisfaction of one or more predefined response property rules.
7. The method of claim 1 , further comprising the step of performing one or more predefined mitigation actions for a detected attack.
8. The method of claim 1 , wherein, in response to receiving the at least one response packet with said tracing flag identifier, the at least one cloud provider performs the following additional step: remove the tracing flag identifier from the at least one response packet.
9. The method of claim 1 , wherein the notification further comprises one or more of an identifier of the session and an identifier of a potential attackee.
10. The method of claim 9 , wherein the following steps performed by the at least one cloud provider in response to receiving the at least one response packet with said tracing flag identifier further comprise the step of determining the identifier of the corresponding session based on the tracing flag identifier.
11. A computer program product, comprising a non-transitory machine-readable storage medium having encoded therein executable code of one or more software programs, wherein the one or more software programs when executed by at least one processing device perform the following steps:
detecting a potential attack associated with a session from a potential attacker based on one or more predefined anomaly detection criteria;
adding a tracing flag identifier to at least one response packet;
sending a notification to at least one cloud provider of the potential attack, wherein the notification comprises the tracing flag identifier; and
sending the at least one response packet to the potential attacker,
wherein, in response to receiving the at least one response packet with said tracing flag identifier, the at least one cloud provider performs the following steps:
determine a source of the potential attack based on a destination of the at least one response packet;
forward the at least one response packet to the potential attacker based on the destination of the at least one response packet; and
monitor the determined source to evaluate the potential attack.
12. The computer program product of claim 11 , further comprising the step of identify a potential source of the potential attack using a list of suspected Internet Protocol addresses.
13. The computer program product of claim 11 , further comprising the step of identifying one or more cloud providers associated with the potential attack based on an originating Internet Protocol address of the session.
14. The computer program product of claim 11 , wherein the step of sending the at least one response packet to the potential attacker is delayed one or more of by a predefined time duration and until said at least one cloud provider has acknowledged receipt of the notification.
15. The computer program product of claim 11 , wherein the notification is sent to the at least one cloud provider using an application programming interface.
16. An apparatus, comprising:
a memory; and
at least one processing device, coupled to the memory, operative to implement the following steps:
detecting a potential attack associated with a session from a potential attacker based on one or more predefined anomaly detection criteria;
adding a tracing flag identifier to at least one response packet;
sending a notification to at least one cloud provider of the potential attack, wherein the notification comprises the tracing flag identifier; and
sending the at least one response packet to the potential attacker,
wherein, in response to receiving the at least one response packet with said tracing flag identifier, the at least one cloud provider performs the following steps:
determine a source of the potential attack based on a destination of the at least one response packet;
forward the at least one response packet to the potential attacker based on the destination of the at least one response packet; and
monitor the determined source to evaluate the potential attack.
17. The apparatus of claim 16 , further comprising the step of identify a potential source of the potential attack using a list of suspected Internet Protocol addresses.
18. The apparatus of claim 16 , further comprising the step of identifying one or more cloud providers associated with the potential attack based on an originating Internet Protocol address of the session.
19. The apparatus of claim 16 , wherein the step of sending the at least one response packet to the potential attacker is delayed one or more of by a predefined time duration and until said at least one cloud provider has acknowledged receipt of the notification.
20. The apparatus of claim 16 , wherein the notification is sent to the at least one cloud provider using an application programming interface.