Hypervisor-Mediated PCIe DoS Blocking via Doorbell Rate Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional techniques are slow to detect and halt Denial of Service (DoS) attacks on computing systems, which can significantly reduce communication bandwidth and disrupt services.
Innovation Solution
Implementing a system that monitors doorbell rates and resource utilization to identify potential DoS attacks on Peripheral Component Interconnect Express (PCIe) devices, and triggers the hypervisor to halt the attack by disabling the offending virtual machines or virtual functions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If conventional detection techniques are used to identify DoS attacks, then the system can maintain normal operation, but the detection speed is slow and the attack cannot be halted in time
Solution Approach 1:
The system performs preliminary action by monitoring doorbell rates and resource utilization metrics continuously before a DoS attack fully cripples the system. The hypervisor is prepared to rapidly disable offending virtual machines or functions once thresholds are exceeded, preventing the attack from taking effect rather than responding after damage occurs.
2Measurement precision
If the system monitors doorbell rates and resource utilization to detect DoS attacks, then detection accuracy improves, but system complexity increases
Solution Approach 1:
The hypervisor serves as an intermediary layer between the PCIe device and virtual machines, implementing the monitoring logic for doorbell rates and resource utilization. This intermediary approach allows precise measurement of attack indicators without requiring complex modifications to the underlying PCIe device or guest operating systems, as the hypervisor naturally sits in the communication path and can observe metrics.
3Reliability
If the hypervisor disables offending virtual machines to halt DoS attacks, then service interruption is prevented, but system availability to legitimate users may be temporarily affected
Solution Approach 1:
The system applies preliminary anti-action by preemptively disabling virtual machines that exhibit doorbell rate patterns consistent with DoS attacks, before the attacks can fully degrade service. The hypervisor monitors for suspicious patterns and takes corrective action in advance, preventing backpressure from accumulating and ensuring service continuity for legitimate users without prolonged disruption.
Data Source
AI summary
Apparatuses, systems, and techniques to detect a Denial of Service (DoS) attack on a target device by an entity. In at least one embodiment, the detection is followed by an event message to prevent the entity from sending further communications to the target device.