DETECTION AND MITIGATION OF FLOOD TYPE DDOS ATTACKS AGAINST CLOUD-HOSTED APPLICATIONS

• US 20180255094A1
• Filed: 08/24/2017
• Published: 09/06/2018
• Est. Priority Date: 03/06/2017
• Status: Active Grant

• Current Assignee: Radware Limited
• Original Assignee: Radware Limited
• Inventors: DORON, Ehud, Ilani, Nir, AVIV, David, BEN EZRA, Yotam, BISMUT, Amit, ARBITMAN, Yuriy
• Granted Patent: US 11,539,739 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 2463/141 Denial of service attacks against endpoints in a network
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

A system and method for protecting cloud-hosted applications against hypertext transfer protocol (HTTP) flood distributed denial-of-service (DDoS) attacks are provided. The method includes collecting telemetries from a plurality of sources deployed in at least one cloud computing platform hosting a protected cloud-hosted application; providing at least one rate-based feature and at least one rate-invariant feature based on the collected telemetries, wherein the rate-based feature and the rate-invariant feature demonstrate behavior of at least HTTP traffic directed to the protected cloud-hosted application; evaluating the at least one rate-based feature and the at least one rate-invariant feature to determine whether the behavior of the at least HTTP traffic indicates a potential HTTP flood DDoS attack; and causing execution of a mitigation action when an indication of a potential HTTP flood DDoS attack is determined.

Claims

1. A method for protecting cloud-hosted applications against hypertext transfer protocol (HTTP) flood distributed denial-of-service (DDoS) attacks, comprising:

collecting telemetries from a plurality of sources deployed in at least one cloud computing platform hosting at least one protected cloud-hosted application;

providing at least one rate-based feature and at least one rate-invariant feature based on the collected telemetries, wherein the rate-based feature and the rate-invariant feature demonstrate behavior of at least HTTP traffic directed to the at least one protected cloud-hosted application;

evaluating the at least one rate-based feature and the at least one rate-invariant feature to determine whether the behavior of the at least HTTP traffic indicates a potential HTTP flood DDoS attack; and

causing execution of a mitigation action when an indication of a potential HTTP flood DDoS attack is determined.

2. The method of claim 1, wherein the at least one cloud computing platform further includes one or more on-premises locations.

3. The method of claim 1, wherein the at least one protected cloud-hosted application is hosted in a plurality of cloud computing platforms of different vendors that includes one on-premises locations.

4. The method of claim 1, wherein the collected telemetries include at least one of:

a number of HTTP methods requests originating from all end-user devices currently accessing the at least one protected cloud-hosted application, a number of processed bytes of HTTP traffic directed to the at least one protected cloud-hosted application.

5. The method of claim 4, wherein the least one rate-based feature is at least a number of HTTP requests per second (RPS) directed to the at least one protected cloud-hosted application and the rate-invariant feature is at least an average size of HTTP requests (ARS) directed to the at least one protected cloud-hosted application.

6. The method of claim 1, wherein evaluating the at least one rate-based feature and the at least one rate-invariant feature further comprises:

evaluating, using a fuzzy logic inference engine, a normal degree of fulfilment (DoF) score, a suspicious DoF score, and an attack DoF score.

7. The method of claim 6, further comprising:

evaluating, using an expert system, a degree of attack (DoA) score based on the maximum DoF scores computed for the normal DoF score, the suspicious DoF score and the attach DoF score; and

comparing the DoA score to a predefined threshold, wherein an indication of a potential HTTP flood DDoS attack is determined when the DoA score exceeds the predefined threshold.

8. The method of claim 7, wherein the DoA score indicates a potential HTTP flood DDoS attack when the at least one rate-base feature demonstrates an increase and the at least one rate-invariant feature demonstrates a decrease or an increase.

9. The method of claim 1, wherein causing execution of a mitigation action further comprises:

redirecting traffic destined to the at least one protected cloud-hosted application to a mitigation resource for at least cleaning the traffic; and

sending the clean traffic to the destined protected cloud-hosted application.

10. The method of claim 9, wherein the mitigation resource and a detection resource are deployed in a defense cloud computing platform that is out-of-path from the at least one cloud computing platform hosting the at least one protected cloud-hosted application.

11. A non-transitory computer readable medium having stored thereon instructions for causing processing circuity to perform the method of claim 1.

12. A system for protecting cloud-hosted applications against hypertext transfer protocol (HTTP) flood distributed denial-of-service (DDoS) attacks, comprising:

a processing circuity; and

a memory connected to the processor, the memory contains instructions that when executed by the processing circuity, configure the system to;

collect telemetries from a plurality of sources deployed in at least one cloud computing platform hosting at least one protected cloud-hosted application;

provide at least one rate-based feature and at least one rate-invariant feature based on the collected telemetries, wherein the rate-based feature and the rate-invariant feature demonstrate behavior of at least HTTP traffic directed to the at least one protected cloud-hosted application;

evaluate the at least one rate-based feature and the at least one rate-invariant feature to determine whether the behavior of the at least HTTP traffic indicates a potential HTTP flood DDoS attack; and

cause execution of a mitigation action, when an indication of a potential HTTP flood DDoS attack is determined.

13. A method for protecting cloud-hosted applications against transmission control protocol (TCP) flood distributed denial-of-service (DDoS) attacks, comprising:

collecting telemetries from a plurality of sources deployed in at least one cloud computing platform hosting at least one protected cloud-hosted application;

providing at least one rate-based feature and at least one rate-invariant feature based on the collected telemetries, wherein the rate-based feature and the rate-invariant feature demonstrate behavior of at least TCP connections established with a server hosting the at least one protected cloud-hosted application;

evaluating the at least one rate-based and the at least one rate-invariant feature to determine whether their behavior indicates a potential TCP flood DDoS attack; and

causing execution of a mitigation action, when an indication of a potential TCP flood DDoS attack is determined.

14. The method of claim 13, wherein the at least one cloud computing platform further includes one or more on-premises locations.

15. The method of claim 13, wherein the protected cloud-hosted application is hosted in a plurality of cloud computing platforms of various vendors that includes one or on-premises locations.

16. The method of claim 13, wherein the collected telemetries include at least one of:

a new TCP connections count, a concurrent active TCP connections count, a number of processed bytes of TCP connections directed to the protected by the cloud-hosted application.

17. The method of claim 16, wherein the at least one rate-base feature is any one of:

a number of new TCP connections per second (NCPS);

a number of concurrent TCP connections per second (ACPS), and wherein the at least one rate-invariant feature is at least an average TCP connection size (ACS).

18. The method of claim 13, wherein evaluating the feature further comprising:

evaluate, using a FIS engine, a normal degree of fulfilment (DoF) score, a suspicious DoF score, and an attack DoF score.

19. The method of claim 18, further comprising:

evaluating, using an expert system, a degree of attack (DoA) score based on the maximum DoF scores computed over all the DoF scores of all features; and

comparing the DoA score to a predefined threshold, wherein an indication of a potential TCP flood DDoS attack is determined when the DoA score exceeds the predefined threshold.

20. The method of claim 19, wherein the DoA score indicates the potential TCP flood DDoS attack when the at least one rate-base feature demonstrates an increase and the at least one rate-invariant feature demonstrates an increase or a decrease.

21. The method of claim 13, wherein causing execution of a mitigation action further comprising:

redirecting traffic destined to the at least one protected cloud-hosted application to a mitigation resource for at least cleaning the traffic; and

sending the clean traffic to the destined protected cloud-hosted application.

22. The method of claim 21, wherein the mitigation resource and a detection resource are deployed in a defense cloud computing platform that is out-of-path from the at least one cloud computing platform hosting the at least one protected cloud-hosted application.

23. A non-transitory computer readable medium having stored thereon instructions for causing processing circuity to perform the method of claim 13.

24. A system for protecting cloud-hosted applications against transmission control protocol (TCP) flood distributed denial-of-service (DDoS) attacks, comprising:

a processing circuity; and

a memory connected to the processor, the memory contains instructions that when executed by the processing circuity, configure the system to;

collect telemetries from a plurality of sources deployed in at least one cloud computing platform hosting at least one protected cloud-hosted application;

provide at least one rate-based feature and at least one rate-invariant feature based on the collected telemetries, wherein the rate-based feature and the rate-invariant feature demonstrate behavior of at least TCP connections established with a server hosting the at least one protected cloud-hosted application;

evaluate the at least one rate-based and the at least one rate-invariant feature to determine whether their behavior indicates a potential TCP flood DDoS attack; and

cause execution of a mitigation action, when an indication of a potential TCP flood DDoS attack is determined.