Downloaded 18 times
Uploaded byImperva Incapsula
D3TLV17- Advanced DDoS Mitigation Techniques
The document discusses advanced DDoS mitigation techniques, highlighting the various types of DDoS attacks, such as application layer and volumetric attacks. It emphasizes the challenges in mitigating such attacks, including the need for rapid response, scalable resources, and agile network infrastructure. The overview concludes with insights into the infrastructure needed for effective DDoS defense, exemplified by the capabilities of the 'Behemoth' mitigation system.
More Related Content
Similar to D3TLV17- Advanced DDoS Mitigation Techniques
More from Imperva Incapsula
![[Webinar] DDoS Pentester Reveals: How Hackers Find Your Website’s Weak Points...](https://cdn.slidesharecdn.com/ss_thumbnails/webinar-151105191522-lva1-app6892-thumbnail.jpg?width=640&height=640&fit=bounds)
![5G Explained! A High Level Overview [Introduction]](https://cdn.slidesharecdn.com/ss_thumbnails/5gexplainedahighleveloverview-260119165306-cc137a3e-thumbnail.jpg?width=640&height=640&fit=bounds)
D3TLV17- Advanced DDoS Mitigation Techniques
- 1. Advanced DDoS MitigationTechniques Tomer Shani Infrastructure Protection Development Group Manager, Imperva
- 2. BIO Tomer Shani Three kids, Threecats. Three years at Imperva Incapsula Various R&D positions, all in thee field of networking Plan for the worst, only the paranoid survive © 2017 Imperva, Inc. All rights reserved.2
- 3. Introduction to DDoS ©2017 Imperva, Inc. All rights reserved.3 Distributed Denial of Service Denial of Service: • Resource exhaustion • Exploit: Network capacity, infrastructure, compute or applicative weaknesses • Will eventually lead to service being unavailable Why “Distributed”? • Difficult to track, contain and prevent • Enabler for mega-scale attacks Attack Types Application Layer • Aimed at specific services Network Layers 3/4 • Volumetric attack – consuming bandwidth • PPS attacks – consuming network equipment capacity • Syn flood/Connection flood – target server’s network stack resources
- 4. Introduction to DDoS– Cont. © 2017 Imperva, Inc. All rights reserved.4 DDoS is Easy • Stressers (DDoSers/Booters) will offer you to “test” your website, these saints will offer a premium service: • And in some cases very happy to share their method of exploit
- 5. Introduction to DDoS– Cont. © 2017 Imperva, Inc. All rights reserved.5 Motivation • Hacktivism • Vandalism • Competition • Extorsion
- 6. Introduction to DDoS– Cont. © 2017 Imperva, Inc. All rights reserved.6 The Impact
- 7. DDoS in theWild – Challenging Mitigation Resources © 2017 Imperva, Inc. All rights reserved.7 Volumetric Attacks PPS Attacks
- 8. DDoS in theWild – Challenging Mitigation Tactics © 2017 Imperva, Inc. All rights reserved.8 Changing Attack Vectors Pulse Wave DDoS
- 9. Challenges in AttackMitigation Fast! Time to Mitigation • Minimal service impact • Attack which goes through provider may get network null routed – Minutes of impact may take hours to fix • Pulse waves • Changing attack vectors Latency • Latency should not degrade when scrubbing is in progress Volume • Distribute network capacity • Equip to handle high PPS attacks and volumetric attacks Agility • React to evolving threats in real-time © 2017 Imperva, Inc. All rights reserved.9
- 10. Network Topology © 2017Imperva, Inc. All rights reserved.10
- 11. Meet the Behemoth ©2017 Imperva, Inc. All rights reserved.11
- 12. Under the Hood Behemoth2 Sampling (10G) Mitigation core CPU ALTA Switch © 2017 Imperva, Inc. All rights reserved.12 DDoS Traffic (160G) Traffic (400G)
- 13. PEACE TIME Mitigation Core ©2017 Imperva, Inc. All rights reserved.13 Sampled Traffic 1:40 Attack Traffic . . . 16*10G -> 160 Gbps Detection Core Mitigation Core WAR TIME
- 14. Performance Challenges Scaling upthe muscle Detection Core Brain 75% CPU Mitigation Core Muscle 99% CPU © 2017 Imperva, Inc. All rights reserved.14
- 15. Heavy Lifting © 2017Imperva, Inc. All rights reserved.15 Behemoth 2 Sampling Core Mitigation CPU Clean Traffic QFX SwitchISP ALTA Switch
- 16. Heavy Lifting © 2017Imperva, Inc. All rights reserved.16 Behemoth 2 DDoS Traffic QFX SwitchISP ALTA Switch Sampling Core Mitigation CPU Scrubbed Traffic
- 18. Heavy Lifting © 2017Imperva, Inc. All rights reserved.18 Behemoth 2 Sampling Core Mitigation CPU Clean Traffic QFX SwitchISP ALTA Switch Scrubbed Traffic
- 20. Revisiting the 650GDDoS © 2017 Imperva, Inc. All rights reserved.20
Editor's Notes
- #5 https://www.incapsula.com/ddos/booters-stressers-ddosers.html https://www.incapsula.com/blog/unmasking-ddos-for-hire-fiverr.html And even goes as low as 5$ (Fivrr)
- #6 TODO: remove ad from the russian bank piece https://en.wikipedia.org/wiki/2016_Dyn_cyberattack http://www.zdnet.com/article/krebs-on-security-booted-off-akamai-network-after-ddos-attack-proves-pricey/
- #7 TODO: remove ad from the russian bank piece https://en.wikipedia.org/wiki/2016_Dyn_cyberattack http://www.zdnet.com/article/krebs-on-security-booted-off-akamai-network-after-ddos-attack-proves-pricey/
- #8 https://www.incapsula.com/blog/throughput-forwarding-rate-ddos-attacks.html https://www.incapsula.com/blog/650gbps-ddos-attack-leet-botnet.html Targeting network resources
- #9 https://www.incapsula.com/blog/pulse-wave-ddos-pins-down-multiple-targets.html Targeting mitigation tactics Pulse waves aiming to expoit on off services / manual mitigation
- #10 - Icon is a suggestion. Seems like the slide could use a visual.
- #11 Similar location maps for other vendors, only incapsula has the same scrubbing map as the CDN map. Scrubbing center vs scrubbing at the source Latency – no need to haul traffic Attacks are split up, attackers ability to congest a given datacenter is very low
- #13 Customized hardware consisting of al Intel CPU running Ubuntu LTS And Intel switching silicon with 400G of external bandwidth (10G nics) & 200G of internal bandwidth (PCIE)
- #14 Dive into the behemoth Detection core will take decisions at a sub-second resolution Decisions are fully automated All software based – software is high performance lockless code Houses software rules which can be updated globally / per account (perfromed by the incapsula SOC) New version released every week
- #15 Don’t wait for things to scale to start thinking about measuring. you won’t see that things are breaking or about to break and you will miss huge opportunity for improvement. DDoS mitigation is at the core of what we do, hence we can’t run into glass ceilings in that area.
- #16 Dive into the behemoth
- #17 Dive into the behemoth
- #19 Dive into the behemoth
- #21 Revisiting the 650G attack, let revisit the PPS numbers Some pulse waves to test the system, few minutes to regroup and back at full force in a volumetric attack