1. 1 © Nokia 2016
Stopping Malicious
Automated Web Traffic
Public
AT&T Foundry+ Nokia Cybersecurity
Robert Mendelsohn
15-07-2016

2. 2 © Nokia 2016
Automated Traffic:
Case Studies
Public

3. 3 © Nokia 2016
Global Retailer Loses
Millions to Gift Card
Fraud
Gift card program worth $5 billion is
attacked by botnet, steals $25
million
Major Insurance
Website Crashed
Application-layer distributed denial
of service attack succeeds
Major Airline Has
Data Stolen
Airline webpage is attacked by a
botnet
Public
Case Studies

4. 4 © Nokia 2016
Automated Traffic:
Current Methods
Public

5. 5 © Nokia 2016
Per IP
How many requests from this IP
address per unit time?
• IP address is easy to fake
Per Content
How many times has this content
been submitted per unit time?
• Message can be modified
Per Account
How many requests from/for this
account per unit time?
• Attack multiple accounts
Public
Current Methods

6. 6 © Nokia 2016
Automated Traffic:
Dissecting an Attack
Public

7. 7 © Nokia 2016 Public

8. 8 © Nokia 2016 Public

9. 9 © Nokia 2016 Public

10. 10 © Nokia 2016 Public

11. 11 © Nokia 2016 Public

12. 12 © Nokia 2016 Public
What is different between how a human
uses a website and a computer uses a
website?

13. 13 © Nokia 2016
Polymorphism and
Obfuscation
Make it hard for an attacker to
navigate the code and find distinct
elements
Record User Input
Record time between keystrokes,
mouse X and Y coordinates, how
long a user has been on a page in
total
Public
Methods to Inhibit Malicious Automation
Forced Resource
Consumption
User must complete a
computationally expensive task,
making repeated accessing non-
cost-effective

14. 14 © Nokia 2016 Public
Polymorphism and
Obfuscation
Make it hard for an attacker to
navigate the code and find distinct
elements

15. 15 © Nokia 2016 Public
Forced Resource Consumption
Worst Best
Business considerations of
high-volume attacks:
• As a whole, earns
$200M/yr
• Sends out 50B pieces of
spam per day
• $0.00001/spam
$30k/
GFLOP
$30k/
GFLOP
$0.08/
GFLOP
$0.08/
GFLOP
Differences in FLOPS Differences in Memory Latency
8x375,000x
7 ns7 ns
0.6 ns0.6 ns

16. 16 © Nokia 2016 Public
DEMO