AUTOMATED REMEDIATION OF DENIAL-OF-SERVICE ATTACKS IN CLOUD-BASED 5G NETWORKS
Systems, methods, and devices automatically remediate denial-of-service (DOS) attacks on a 5G data and telephone network. An example process counts a number of dynamic ports assigned to a service running on a virtualized resource of the 5G data and telephone network. The process determines whether the number of dynamic ports assigned to the service of the 5G data and telephone network is greater than a first threshold. A processor load of the service running on the virtualized resource of the 5G data and telephone network is retrieved. The processor load of the service may be less than a second threshold, indicating a DOS attack in the 5G data and telephone network. The DOS attack is remediated by taking an action on the host operating system of the virtualized resource of the 5G data and telephone network.
1 . An automated process for remediating denial-of-service (DOS) incidents, comprising:
counting a number of dynamic ports assigned to a service running on a computing resource;
determining the number of dynamic ports assigned to the service is greater than a first threshold, and determining a processor load of the service is less than a second threshold to identify a DoS incident; and
taking an action on the computing resource in response to identifying the DoS incident.
2 . The automated process of claim 1 , wherein the computing resource comprises a virtualized distributed unit, a virtualized central unit, or a virtualized network function of a 5G data and telephone network.
3 . The automated process of claim 1 , wherein the service comprises a secure shell (SSH) service.
4 . The automated process of claim 1 , wherein taking the action on the computing resource comprises closing the dynamic ports assigned to the service.
5 . The automated process of claim 1 , wherein taking the action on the computing resource comprises stopping and restarting the service.
6 . The automated process of claim 1 , wherein taking the action on the computing resource comprises rebooting a host operating system of the computing resource.
7 . The automated process of claim 1 , wherein the first threshold is about 100 ports.
8 . The automated process of claim 7 , wherein the second threshold is about 10% of processor capacity.
9 . An automated process for remediation denial-of-service (DOS) attacks in a 5G data and telephone network, comprising:
counting a number of dynamic ports assigned to a service running on a monitored resource;
determining the number of dynamic ports assigned to the service is greater than a first threshold, and determining a processor load of the service is less than a second threshold to identify a DOS attack; and
remediating the DOS attack in response to identifying the DOS attack.
10 . The automated process of claim 9 , wherein the monitored resource comprises a virtualized distributed unit, a virtualized central unit, or a virtualized network function of a 5G data and telephone network.
11 . The automated process of claim 9 , wherein the service runs on a virtualized distributed unit or a virtualized central unit of a 5G data and telephone network.
12 . The automated process of claim 9 , wherein remediating the DOS attack comprises closing the dynamic ports assigned to the monitored resource.
13 . The automated process of claim 9 , wherein remediating the DOS attack comprises stopping and restarting the monitored resource.
14 . The automated process of claim 9 , wherein remediating the DOS attack comprises rebooting an operating system running the monitored resource.
15 . The automated process of claim 9 , wherein the first threshold is about 100 ports.
16 . The automated process of claim 15 , wherein the second threshold is about 10% of processor capacity.
17 . A non-transitory computer-readable medium configured to store instructions that, when executed by a processor in a 5G data and telephone network, cause the 5G data and telephone network to perform operations, the operations comprising:
counting a number of dynamic ports assigned to a service running on a computing resource;
determining the number of dynamic ports assigned to the service is greater than a first threshold, and determining a processor load of the service is less than a second threshold to identify a DOS attack; and
remediating the DOS attack by taking an action on a host operating system of the computing resource.
18 . The non-transitory computer-readable medium of claim 17 , wherein the computing resource comprises a virtualized distributed unit, a virtualized central unit, or a virtualized network function of the 5G data and telephone network.
19 . The non-transitory computer-readable medium of claim 17 , wherein taking the action on the host operating system comprises stopping and restarting the service.
20 . The non-transitory computer-readable medium of claim 17 , wherein taking the action on the host operating system comprises rebooting the host operating system of the computing resource of the 5G data and telephone network.