Pre-processing system for minimizing application-level denial-of-service in a multi-tenant system
Denial-of-service attacks are prevented or mitigated in a cloud compute environment, such as a multi-tenant, collaborative SaaS system. This is achieved by providing a mechanism by which characterization of “legitimate” behavior is defined for tenant applications or application classes, preferably along with actions to be taken in the event a request to execute an application is anticipated to exceed defined workflow limits. A set of application profiles are generated. Typically, a profile comprises information, such as a request defined by one or more request variables, one or more “constraints,” one or more “request mappings,” and one or more “actions.” A constraint is a maximum permitted workload for the application. A request mapping maps a request variable to the constraint, either directly or indirectly. The profile information defines how a request is mapped to a workload to determine whether the request is in policy or, if not, what action to take.
1. A method of minimizing application-level denial-of-service attacks with respect to compute resources in a multi-tenant shared infrastructure, the method comprising:
profiling anticipated application behavior in response to one or more requests to generate an application profile having at least one workload constraint, the application profile including a mapping of a request type to a workload and a workload limit;
upon receipt of a request, and prior to execution, determining whether execution of the request satisfies the at least one workload constraint in the application profile by evaluating whether the request is predicted to result in a workload that exceeds the workload limit, wherein evaluating whether the request is predicted to result in a workload that exceeds the workload limit includes unzipping a file associated with the request in a separate execution thread to determine if decompression of the file results in the workload that exceeds the workload limit; and
responsive to determining whether execution of the request satisfies the at least one workload constraint in the application profile, taking a given action;
wherein the steps are carried out in software executing in a hardware element.
2. The method as described in claim 1 wherein the given action is one of: throttling execution of the request, rejecting the request, and providing a given notification.
3. The method as described in claim 1 wherein determining whether execution of the request satisfies the at least one workload constraint allocates processing or storage in the multi-tenant shared infrastructure to simulate how execution of the request affects availability of the compute resources.
4. The method as described in claim 1 wherein the determining step executes a number of application operations in a separate execution thread to determine if the number of application operations in the workload exceeds the workload limit.
5. The method as described in claim 1 wherein the anticipated application behavior characterizes legitimate behavior for each of one or more tenant applications in the multi-tenant shared infrastructure.
6. The method as described in claim 5 wherein the anticipated application behavior is profiled as a machine-encoded data set.
7. The method as described in claim 1 wherein determining if decompression of the file results in the workload that exceeds the workload limit evaluates drain on system memory.