Tracing Mechanism for FaaS Session Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network analysis tools are ineffective in detecting cyberattacks that utilize Function as a Service (FaaS) platforms, as these attacks are short-lived and leave minimal trace information, making it difficult to identify the attacker's source IP address.
Innovation Solution
A tracing mechanism is implemented to detect potential attacks by adding a tracing flag identifier to response packets, which notifies cloud providers to monitor and identify the source of the attack, even in FaaS-based scenarios, allowing for real-time tracing and forensic analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cloud providers use FaaS platforms with frequent IP address changes, then attacker detection becomes more difficult, but cloud provider anonymity and attack resilience are improved
Solution Approach 1:
The system implements feedback by inserting tracing flags into response packets that loop back to the cloud provider, creating a closed-loop information flow that enables continuous monitoring and identification of attack sources without disrupting service
Solution Approach 2:
The tracing flag acts as an intermediary element embedded in communication packets, carrying identification information between the cloud provider and the potential attacker without requiring direct exposure of the attacker's identity
2Difficulty of detecting and measuring
If network analysis tools monitor all traffic, then attack detection capability is improved, but system complexity and processing overhead increase
Solution Approach 1:
The system extracts only the essential tracing flag information from communication packets for analysis, rather than monitoring entire packet contents, reducing processing complexity while maintaining detection capability
Solution Approach 2:
The tracing mechanism applies localized monitoring only to packets containing the specific tracing flag identifier, rather than uniformly analyzing all network traffic, optimizing resource usage
3Measurement precision
If response packets are delayed for tracing analysis, then attack source identification is improved, but legitimate traffic latency increases
Solution Approach 1:
The system applies tracing delays selectively only to packets containing the tracing flag identifier, while allowing normal packets to pass through without delay, minimizing impact on legitimate traffic
Solution Approach 2:
The tracing flag is inserted into response packets in advance, allowing the cloud provider to prepare monitoring resources before the attack sequence completes, enabling faster identification without extensive post-attack analysis
Data Source
AI summary
A tracing mechanism is provided for analyzing session-based attacks. An exemplary method comprises: detecting a potential attack associated with a session from a potential attacker based on predefined anomaly detection criteria; adding a tracing flag identifier to a response packet; sending a notification to a cloud provider of the potential attack, wherein the notification comprises the tracing flag identifier; and sending the response packet to the potential attacker, wherein, in response to receiving the response packet with the tracing flag identifier, the cloud provider: determines a source of the potential attack based on a destination of the response packet; forwards the response packet to the potential attacker based on the destination of the response packet; and monitors the determined source to evaluate the potential attack. The response packet is optionally delayed by a predefined time duration and/or until the cloud provider has acknowledged receipt of the notification.