PREVENTING DISTRIBUTED DENIAL OF SERVICE ATTACKS IN REAL-TIME
In an embodiment, a process for preventing distributed denial of service attacks in real-time includes sending received packets to a learning manager to detect a change in a traffic pattern. In response to the learning manager detecting the change in the traffic pattern, the process determines a set of Top-N analysis fields that corresponds to the change in the traffic pattern. The process performs Top-N analysis on received packets to determine a set of values associated with the set of Top-N analysis fields. The process obtains an updated policy based at least in part on the set of values, and checks incoming packets against the updated policy.
1 . A method comprising:
sending received packets to a learning manager to detect a change in a traffic pattern;
in response to the learning manager detecting the change in the traffic pattern, determining a set of Top-N analysis fields that corresponds to the change in the traffic pattern;
performing Top-N analysis on received packets to determine a set of values associated with the set of Top-N analysis fields;
obtaining an updated policy based at least in part on the set of values; and
checking incoming packets against the updated policy.
2 . The method of claim 1 , wherein the learning manager is trained to generate an attack model based on the traffic.
3 . The method of claim 2 , wherein the attack model is based at least in part on analysis of a plurality of layers of packet data.
4 . The method of claim 1 , further comprising sending a Top-N analysis result to a controller to be aggregated.
5 . The method of claim 1 , wherein the received packets correspond to a domain name service (DNS) request.
6 . The method of claim 5 , wherein the DNS request is for a non-existent domain.
7 . The method of claim 1 , wherein the received packets correspond to a fully qualified domain name (FQDN) with a response size larger than a threshold.
8 . The method of claim 1 , wherein the change in the traffic pattern is based at least in part on extracting a feature of the received packets.
9 . The method of claim 8 , wherein the feature of the received packets is determined based at least in part on a machine learning model.
10 . The method of claim 1 , wherein the determination of a set of Top-N analysis fields is based at least in part on mapping the change in the traffic pattern to an attack type.
11 . The method of claim 1 , wherein the Top-N analysis defines which layer to use to determine whether the request corresponds to an attack.
12 . The method of claim 1 , wherein the Top-N analysis reduces processing cycles including by dropping the packet earlier than a process that does not use the Top-N analysis.
13 . The method of claim 1 , wherein the updated policy is based at least in part on an aggregation of Top-N analysis performed by a plurality of service engines.
14 . The method of claim 13 , wherein the plurality of service engines is distributed across a plurality of physical devices.
15 . The method of claim 14 , wherein the aggregated Top-N analysis is a model at a virtual service level.
16 . The method of claim 1 , wherein the checking of incoming packets against the updated policy is performed in real time to received packets to determine whether an attack is occurring.
17 . A system comprising:
a service engine configured to:
send received packets to a learning manager to detect a change in a traffic pattern;
in response to the learning manager detecting the change in the traffic pattern, determine a set of Top-N analysis fields that corresponds to the change in the traffic pattern;
perform Top-N analysis on received packets to determine a set of values associated with the set of Top-N analysis fields;
obtain an updated policy based at least in part on the set of values; and
check incoming packets against the updated policy; and
a memory coupled to the service engine, the memory configured to provide the service engine with instructions.
18 . A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
sending received packets to a learning manager to detect a change in a traffic pattern;
in response to the learning manager detecting the change in the traffic pattern, determining a set of Top-N analysis fields that corresponds to the change in the traffic pattern;
performing Top-N analysis on received packets to determine a set of values associated with the set of Top-N analysis fields;
obtaining an updated policy based at least in part on the set of values; and
checking incoming packets against the updated policy.