5 ms·
not necessarily... you could use AI to detect attacks or some other methods that I am not aware of.
by awqrre 11y ago
not necessarily... you could use AI to detect attacks or some other methods that I am not aware of.
- alextgordon 11y agoCommander Data, please report to engineering
- awqrre 11y agoSorry I don't understand... Are you saying that AI doesn't require any training?
- TeMPOraL 11y agoHe's saying that we live in 21st, not 24th century.
- ori_b 11y agoDetection is trivial -- "Are we getting orders of magnitude more traffic than average?" What would the AI do?
- fleitz 11y agoThe AI would whitelist traffic, those streams pass through quickly, everything else gets filtered. The problem is your CPUs filter traffic faster than your NICs accept it, thus dropped packets, thus unhappy customers.
- ori_b 11y ago"Excuse me, boss, there's a very robotic voice on the line. It seems to be attempting to negotiate running new fiber to a data center"
- toast0 11y agoMost attacks are trivial to detect, you don't need AI. It's just hard to get useful work done when all your incoming interfaces are overloaded with easily detectable abuse.
- toomuchtodo 11y agoThe "best" way would be to have application logic to detect non-legitimate requests, and make an API call out of band to upstream networking gear to insert a null route for that IP (so as to drop the traffic at the edge before any real "work" takes place on it). In a previous life, I ran physical datacenters, and while the gear wasn't terribly powerful then (we're still worried about running out of memory on core routers, hence why IP blocks don't get sliced up and piecemealed out with the exhaustion of IPv4 space), I'd expect newer hardware to be able to keep up. The network can remain irrational longer than you can stay online.
- Karunamon 11y agoProblem is, beyond a certain volume, even the upstream gear is gonna get saturated just reading the header on the bogus packets and directing them into the bit bucket. It's not unheard of for the larger attacks to take down entire ISPs.
- zo1 11y agoUnless you keep propagating "upstream" and the message gets to the "source" ISP, and they block the actual misbehaving user/account. For all we know, they can kick them off the network after sufficient transgression, and ban their account at the hardware ADSL level (assuming that's what it is). This also presumes the ISP is willing to implement such a feature, and kick-off their paying (albeit infected) users. I don't know much about this stuff, so I'm extrapolating and pseudo-solving.
- toast0 11y agoUsually there's a lot of diversity in the immediate source of the traffic. If it's a volumetric attack, the immediate source is the misconfigured servers that spoofed packets are being sent to. If it's an in band attack, the immediate source is usually botnet members, but occasionally regular browsers being served bad scripts by a compromised or mitmed site. You could work to notify the network owners, but it's whack-a-mole; even with strong efforts there are enough DNS and ntp servers out there configured to generate a pretty big reflection.
- morganvachon 11y agoDetection isn't the issue, mitigation is.