DETECTING ATTACKS ON DATA CENTERS

• US 20160036837A1
• Filed: 08/04/2014
• Published: 02/04/2016
• Est. Priority Date: 08/04/2014
• Status: Abandoned Application

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Jain, Navendu, Miao, Rui
• Application Number:
  US14/450,954
• Publication Number:
  US 20160036837A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

The claimed subject matter includes a system and method for detecting attacks on a data center. The method includes sampling a packet stream by coordinating at multiple levels of data center architecture, based on specified parameters. The method also includes processing the sampled packet stream to identify one or more data center attacks. Further, the method includes generating attack notifications for the identified data center attacks.

Claims

1. A method for detecting attacks on a data center, comprising:

sampling a packet stream by coordinating at multiple levels of data center architecture, based on specified parameters;

processing the sampled packet stream to identify one or more data center attacks; and

generating one or more attack notifications for the identified data center attacks.

2. The method of claim 1, comprising:

determining granular traffic volumes of the packet stream for a plurality of specified time granularities; and

processing the sampled packet stream occurring across one or more of the specified time granularities to identify the data center attacks.

3. The method of claim 2, processing the sampled packet stream comprising:

determining a relative change in the granular traffic volumes; and

determining a volumetric-based attack is occurring based on the relative change.

4. The method of claim 2, processing the sampled packet stream comprising:

determining the granular traffic volumes exceed a specified threshold; and

determining a volumetric-based attack is occurring based on the determination.

5. The method of claim 1, processing the sampled packet stream comprising:

determining fan-in/fan-out ratio for inbound and outbound packets; and

determining an IP address is under attack based on the fan-in/fan-out ratio for the IP address.

6. The method of claim 1, identifying the data center attacks based on TCP flag signatures.

7. The method of claim 1, comprising:

filtering a packet stream of packets from blacklisted nodes, the blacklisted nodes being identified based on a plurality of blacklists comprising traffic distribution system (TDS) nodes and spam nodes; and

filtering a packet stream of packets not from whitelisted nodes, the whitelisted nodes being identified based on a plurality of whitelists comprising trusted nodes.

8. The method of claim 1, the data center attacks being identified in real time.

9. The method of claim 1, the data center attacks being identified offline.

10. The method of claim 1, the data center attacks comprising an inbound attack.

11. The method of claim 1, the data center attacks comprising an outbound attack.

12. The method of claim 1, the data center attacks comprising an inter-datacenter attack, and an intra-datacenter attack.

13. The method of claim 1, coordinating comprising sampling, at each level, a plurality of specified IP addresses of network traffic.

14. The method of claim 1, the data center attacks comprising an attack on a cloud infrastructure comprising the data center.

15. A system for detecting attacks on a data center of a cloud service, comprising:

a distributed architecture comprising a plurality of computing units, each of the computing units comprising;

a processing unit; and

a system memory, the computing units comprising an attack detection engine executed by one of the processing units, the attack detection engine comprising;

a sampler to sample a packet stream in coordination at multiple levels of a data center architecture, based on a plurality of specified time granularities; and

a controller configured to;

determine, based on the packet stream, granular traffic volumes for the specified time granularities;

identify a plurality of data center attacks occurring across one or more of the specified time granularities based on the sampling; and

generate a plurality of attack notifications for the data center attacks.

16. The system of claim 15, the network attack being identified as one or more volume-based attacks based on a specified percentile of traffic distribution over a specified duration.

17. The system of claim 15, coordination comprising sampling, at each level, a plurality of specified IP addresses of inbound network traffic.

18. One or more computer-readable storage memory devices for storing computer-readable instructions, the computer-readable instructions when executed by one or more processing devices, the computer-readable instructions comprising code configured to:

determine, based on a packet stream for the data center, granular traffic volumes for a plurality of specified time granularities;

sample the packet stream using coordination at multiple levels of data center architecture, based on the specified time granularities;

identify a plurality of data center attacks occurring across one or more of the specified time granularities based on the sampling; and

generate a plurality of attack notifications for the data center attacks.

19. The computer-readable storage memory devices of claim 18, the code configured to identify the plurality of attacks in real-time and offline.

20. The computer-readable storage memory devices of claim 18, coordination comprising sampling, at each level, a plurality of specified IP addresses associated with:

outbound network traffic;

or

inbound network traffic.