PCIe Device DoS Protection via Hypervisor VM Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional techniques are slow to detect and halt Denial of Service (DoS) attacks on computing systems, which can significantly reduce communication bandwidth and disrupt services.
Innovation Solution
Implementing a system that monitors doorbell rates and resource utilization to identify potential DoS attacks on Peripheral Component Interconnect Express (PCIe) devices, and triggers an event to notify the hypervisor to halt the attack by disabling the offending virtual machine.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If conventional detection techniques are used to identify DoS attacks, then the system can detect attacks, but the detection speed is slow and the attack cannot be halted in time
Solution Approach 1:
The system performs preliminary action by continuously monitoring doorbell rates and resource utilization metrics before a DoS attack can fully cripple the system. The hypervisor proactively identifies suspicious patterns and halts offending virtual machines preemptively, preventing the attack from reaching its full destructive potential rather than reacting after damage occurs.
Solution Approach 2:
The system implements feedback mechanisms by continuously monitoring doorbell rates, resource utilization, and system performance metrics. This real-time feedback loop enables the hypervisor to detect abnormal patterns indicating DoS attacks and immediately respond by halting the offending virtual machine, creating a closed-loop control system that adapts to emerging threats.
2Measurement precision
If the system monitors all PCIe device communications to detect DoS attacks, then detection accuracy improves, but system overhead and complexity increase
Solution Approach 1:
The system applies local quality by focusing monitoring efforts on specific critical metrics such as doorbell rates and resource utilization of PCIe devices rather than analyzing all communications uniformly. This targeted approach concentrates computational resources on the most indicative parameters for DoS detection, improving accuracy while reducing overall system complexity.
Solution Approach 2:
The system utilizes parameter changes by monitoring variations in doorbell rates and resource utilization metrics over time. By detecting significant deviations from normal parameter ranges and patterns, the system can identify DoS attacks with high accuracy. The hypervisor adjusts monitoring thresholds and parameters dynamically based on system conditions to maintain detection precision.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Apparatuses, systems, and techniques to detect a Denial of Service (DoS) attack on a target device by an entity. In at least one embodiment, the detection is followed by an event message to prevent the entity from sending further communications to the target device.