Protecting from denial of service attacks
Apparatuses, systems, and techniques to detect a Denial of Service (DoS) attack on a target device by an entity. In at least one embodiment, the detection is followed by an event message to prevent the entity from sending further communications to the target device.
1 . A system comprising:
one or more circuits to:
determine a target is potentially under attack by an entity based at least in part on a number of communications sent to one or more memory addresses mapped by one or more registers associated with the target; and
send a notification to prevent the entity from sending additional communications to the one or more memory addresses in response to determining the target is potentially under attack, the target comprising at least one of hardware or firmware.
2 . The system of claim 1 , wherein the entity is a virtual function (“VF”) being performed by a virtual machine (“VM”) managed by a hypervisor.
3 . The system of claim 2 , wherein the notification is sent to the hypervisor, the notification being a notification to disconnect the VM.
4 . The system of claim 3 , wherein disconnecting the VM comprises disabling the VF to prevent the VF from sending additional communications to the to one or more memory addresses.
5 . The system of claim 3 , wherein disconnecting the VM comprises terminating the VM.
6 . The system of claim 1 , wherein determining the target is potentially under attack is based at least in part on the number of communications comprises determining a rate at which the communications are received, and comparing the rate to a threshold rate value.
7 . The system of claim 6 , wherein determining the rate comprises calculating the rate based only on any of the communications determined not to be valid communications.
8 . The system of claim 1 , wherein determining the target is potentially under attack by the entity is based at least in part on a number of communications sent to one or more memory addresses mapped by the one or more registers associated with the target.
9 . The system of claim 8 , wherein the one or more registers associated with the target comprise a plurality of base address registers.
10 . The system of claim 1 , wherein determining the target is potentially under attack by the entity is based at least in part on a number of communications sent to one or more memory addresses mapped to one or more registers that the entity is not authorized to access.
11 . The system of claim 1 , wherein a plurality of additional entities send an additional number of communications to one or more memory addresses mapped to one or more registers, and determining the target is potentially under attack by the entity is based at least in part on a number of communications sent by the entity to one or more memory addresses mapped to one or more registers compared to a number of additional communications sent to one or more memory addresses mapped to one or more registers by the plurality of additional entities.
12 . A method comprising:
determining a target is potentially under attack by an entity based at least in part on a number of communications sent to one or more memory addresses mapped to one or more registers associated with the target; and
sending a notification to prevent the entity from sending additional communications to the one or more memory addresses in response to determining the target is potentially under attack.
13 . The method of claim 12 , wherein the target comprises at least one of hardware or firmware.
14 . The method of claim 12 , wherein the entity is a virtual function (“VF”) being performed by a virtual machine (“VM”) managed by a hypervisor.
15 . The method of claim 14 , wherein sending the notification comprises sending the notification to the hypervisor, the notification being a notification to disconnect the VM.
16 . The method of claim 15 , wherein disconnecting the VM comprises disabling the VF to prevent the VF from sending additional communications to the to one or more memory addresses.
17 . The method of claim 15 , wherein disconnecting the VM comprises terminating the VM.
18 . The method of claim 12 , wherein determining a target is potentially under attack comprises determining a rate at which the communications are received, and comparing the rate to a threshold rate value.
19 . The method of claim 18 , wherein determining the rate comprises calculating the rate based only on any of the communications determined not to be valid communications.
20 . The method of claim 12 , wherein determining the target is potentially under attack by the entity comprises determining a number of communications sent to one or more memory addresses mapped to one or more registers associated with the target.
21 . The method of claim 20 , wherein the one or more registers associated with the target comprise a plurality of base address registers.
22 . The method of claim 12 , wherein determining the target is potentially under attack by the entity comprises determining a number of communications sent to one or more memory addresses mapped to one or more registers that the entity is not authorized to access.
23 . The method of claim 12 , wherein a plurality of additional entities send an additional number of communications to one or more memory addresses mapped to one or more registers, and determining the target is potentially under attack by the entity comprises determining a number of communications sent by the entity to one or more memory addresses mapped to one or more registers compared to a number of additional communications sent to one or more memory addresses mapped to one or more registers by the plurality of additional entities.
24 . A non-transitory machine-readable medium for use with a computer network, the non-transitory machine readable medium having stored thereon a set of instructions, which if performed by one or more processors, cause the one or more processors to at least:
determining a target is potentially under attack by an entity based at least in part on a number of communications sent to one or more memory addresses mapped to one or more registers associated with the target; and
sending a notification to prevent the entity from sending additional communications to the one or more memory addresses in response to determining the target is potentially under attack.
25 . The non-transitory machine-readable medium of claim 24 , wherein the target comprises at least one of hardware or firmware.
26 . The non-transitory machine-readable medium of claim 24 , wherein the entity is a virtual function (“VF”) being performed by a virtual machine (“VM”) managed by a hypervisor.
27 . The non-transitory machine-readable medium of claim 26 , wherein sending the notification comprises sending the notification to the hypervisor, the notification being a notification to disconnect the VM.
28 . The non-transitory machine-readable medium of claim 27 , wherein disconnecting the VM comprises disabling the VF to prevent the VF from sending additional communications to the to one or more memory addresses.
29 . The non-transitory machine-readable medium of claim 27 , wherein disconnecting the VM comprises terminating the VM.
30 . The non-transitory machine-readable medium of claim 24 , wherein the set of instructions, which if performed by the one or more processors, cause the one or more processors to at least determine a target is potentially under attack comprises determining a rate at which the communications are received, and comparing the rate to a threshold rate value.
31 . The non-transitory machine-readable medium of claim 30 , wherein determining the rate comprises calculating the rate based only on any of the communications determined not to be valid communications.
32 . The non-transitory machine-readable medium of claim 24 , wherein determining the target is potentially under attack by the entity comprises determining a number of communications sent to one or more memory addresses mapped to one or more registers associated with the target.
33 . The non-transitory machine-readable medium of claim 32 , wherein the one or more registers associated with the target comprise a plurality of base address registers.
34 . The non-transitory machine-readable medium of claim 24 , wherein the set of instructions, which if performed by the one or more processors, cause the one or more processors to at least determine the target is potentially under attack by the entity by determining a number of communications sent to one or more memory addresses mapped to one or more registers that the entity is not authorized to access.
35 . The non-transitory machine-readable medium of claim 24 , wherein a plurality of additional entities send an additional number of communications to one or more memory addresses mapped to one or more registers the set of instructions, which if performed by the one or more processors, cause the one or more processors to at least determine the target is potentially under attack by the entity by determining a number of communications sent by the entity to one or more memory addresses mapped to one or more registers compared to a number of additional communications sent to one or more memory addresses mapped to one or more registers by the plurality of additional entities.