Data center architecture that supports attack detection and mitigation

Abstract

Described in this article are various techniques for identifying inbound and outbound network and application attacks relative to the data center. The commercial server is used to monitor the ingress service flow and the egress service flow, and detect anomalies in the service flow. In response to detecting the anomaly, a mitigation strategy is executed to mitigate damage caused by the cyber attack.

Description

Background technique [0001] Cloud services are growing rapidly - the market for cloud services is expected to reach hundreds of billions of dollars in the relatively near future. Cloud services are hosted on a data center or group of data centers, where a data center includes numerous computing devices and network infrastructure devices that support computing, networking, and storage services. However, the devices in data centers and the services hosted in those devices are unfortunately increasingly the targets of cyberattacks. Datacenters have been targeted by cyber attackers for at least two reasons: 1) A datacenter or a network of datacenters can have thousands to tens of thousands of different services, so attacking a datacenter can lead to serious and sometimes staggering consequences 2) In addition to hosting malware, stealing confidential data, disrupting competitor services, and selling compromised virtual machines (VMs) in the underground economy, attackers can expl...

AI Technical Summary

Problems solved by technology

Therefore, in order to handle the volume of traffic flowing through and across the data center, as well as to deal with the growing volume of DoS attacks, the use of the above hardware appliances will incur significant costs

Additionally, these devices must be deployed in a redundant fashion, which further increases acquisition and operating costs

[0005] Second, hardware devices are relatively inflexible

Additionally, hardware devices have limited effectiveness against increasingly sophisticated attacks such as zero-day attacks

Finally, hardware devices may not keep up with operating system (OS) firmware and builds, which risks reducing their effectiveness against attacks

[0006] Third, collateral damage can be associated with such hardware devices

Since many attacks can mount in tens of seconds to minutes, the delay in detecting an anomaly or attack risks overloading the target VM as well as the data center's infrastructure (e.g., firewalls, load balancers, and core links), which can be detrimental to common collateral damage caused by escrow lessee

In addition, if the hardware device cannot quickly identify when the attack is gone, it may falsely block legitimate business

Therefore, given that many security solutions apply business analytics and smoothing techniques to reduce false positives for attack detection, such solutions may not be able to act fast enough to avoid collateral damage

Images