How We Blocked a 650Gb DDoS Attack Over Lunch

•

2 gostaram•5,728 visualizações

Recently, our network was hit with one of the largest DDoS attacks the Internet has seen. We’ll describe the technology and peering architecture used to mitigate the attack. Find out how we enjoyed lunch while automatically mitigating an enormous attack with zero downtime.

Tecnologia

© 2017 Imperva, Inc. All rights reserved.
Blocking a 650 Gbps DDoS
Attack Over Lunch
Robert Hamilton – Imperva Incapsula
Infosecurity Europe – June 2017

© 2017 Imperva, Inc. All rights reserved.2
DDoS Attacks
Bigger than ever
2009 2012 2014 2016
100
300
500
700
2017
1,000
60 Gbps
300 Gbps
1 Tbps
(Dyn)
600 Gbps
(Krebs Blog)
Data blast equal to 15 HD movies per SECOND

© 2017 Imperva, Inc. All rights reserved.
DDoS Mitigation
It Takes a Monster
3
• A mighty animal
• Something of monstrous size
• A Behemoth
– Massive throughput
– Software intensive
– Designed and built by us

© 2017 Imperva, Inc. All rights reserved. Confidential4
21 December 2016

© 2017 Imperva, Inc. All rights reserved.
Lunchtime at the NOC, 08:56:00 UTC

© 2017 Imperva, Inc. All rights reserved. Confidential7
Let’s Go Back in Time…

© 2017 Imperva, Inc. All rights reserved.8
Before Behemoth

© 2017 Imperva, Inc. All rights reserved.
Performance Challenges
Start Measuring Everything as Early as Possible
Detection Core
Brain
75% CPU
Muscle
99% CPU
Mitigation Core

© 2017 Imperva, Inc. All rights reserved.
Mitigation by HW
Process packets at line rate using software
The “brain” detects and applies the right mitigation policy
Brain then offloads mitigation to specially designed hardware

© 2017 Imperva, Inc. All rights reserved. Confidential11
Before Behemoth

© 2017 Imperva, Inc. All rights reserved. Confidential12
After Behemoth

© 2017 Imperva, Inc. All rights reserved. Confidential13
21 December 2016

Confidential14
650Gbps Throughput
Hit wave
Behemoth
Networked Behemoths

© 2017 Imperva, Inc. All rights reserved.
Layered Network
• 20 x Local PoPs – 40G
– CDN, small/medium size DDoS
– Serve limited regions
• 10 x Super PoPs – 500G
– Large DDoS
– Cover gaps and out of region traffic
Confidential15
We Optimize for Both CDN and DDoS
Europe Network

© 2017 Imperva, Inc. All rights reserved.
Want the Full Story?
Clear here to read the blog “650Gbps DDoS Attack from the Leet Botnet”
https://www.incapsula.com/blog/650gbps-ddos-attack-leet-botnet.html
Confidential16

How We Blocked a 650Gb DDoS Attack Over Lunch

Mais conteúdo relacionado

Mais procurados

Cloud Surfing: Kubernetes on MesosKubeAcademy

Secure your Hadoop clusters with BlueTalon SecureAccess for WebHDFSIsabelle Dumont

Women Who CodeEverett Toews

CloudFlare DDoS attacks 101: what are they and how to protect your site?Cloudflare

Students to Business Day 2012: Maarten BalliauwFrederik De Bruyne

Rhipe @Netpluz CS Event Nov 2017Netpluz Asia Pte Ltd

PLNOG19 - Sławomir Janukowicz - Zestaw uzbrojenia na wyposażeniu wykonujących...PROIDEA

Mais procurados (7)

Cloud Surfing: Kubernetes on Mesos

Secure your Hadoop clusters with BlueTalon SecureAccess for WebHDFS

Women Who Code

CloudFlare DDoS attacks 101: what are they and how to protect your site?

Students to Business Day 2012: Maarten Balliauw

Rhipe @Netpluz CS Event Nov 2017

PLNOG19 - Sławomir Janukowicz - Zestaw uzbrojenia na wyposażeniu wykonujących...

Destaque

Imperva pptImperva

Extend Enterprise Application-level Security to Your AWS EnvironmentImperva

Database Security, Better Audits, Lower CostsImperva

5 Steps to a Secure Hybrid Architecture - Session Sponsored by Palo Alto Netw...Amazon Web Services

20171109 Amazon EC2 GPUインスタンス最新動向 P3 instanceAmazon Web Services Japan

Licensing Windows Workloads on AWS - AWS Online Tech TalksAmazon Web Services

AWS Step Functions - Dev lounge Express Edition.pdfAmazon Web Services

AWS AI SolutionsAmazon Web Services Japan

Destaque (8)

Imperva ppt

Extend Enterprise Application-level Security to Your AWS Environment

Database Security, Better Audits, Lower Costs

5 Steps to a Secure Hybrid Architecture - Session Sponsored by Palo Alto Netw...

20171109 Amazon EC2 GPUインスタンス最新動向 P3 instance

Licensing Windows Workloads on AWS - AWS Online Tech Talks

AWS Step Functions - Dev lounge Express Edition.pdf

AWS AI Solutions

Semelhante a How We Blocked a 650Gb DDoS Attack Over Lunch

D3TLV17- Advanced DDoS Mitigation TechniquesImperva Incapsula

D3TLV17- Keeping it SafeImperva Incapsula

Cloud Migration with Confidence: 7 Keys to SuccessNew Relic

Small Cell Forum: Security BriefingSmall Cell Forum

Journey to the Modern App with Containers, Microservices and Big DataLightbend

Powering Predictive Mapping at Scale with Spark, Kafka, and Elastic Search: S...Spark Summit

How to Use the TICK Stack, CoreOS, & Docker to Make Your SaaS Offering BetterDevOps.com

How to Use the TICK Stack, CoreOS, & Docker to Make Your SaaS Offering BetterDeborah Schalm

The Open Sourcing of InfrastructureAll Things Open

PuppetConf 2017 | Adobe Advertising Cloud: A Lean Puppet Workflow to Support ...Nicolas Brousse

PuppetConf 2017: Adobe Advertising Cloud: Lean Puppet Workflow to Support Mul...Puppet

The Stakes Have Changed – The Changing Security Landscape by Tony TeoMyNOG

A Journey to Modern Apps with Containers, Microservices and Big DataEdward Hsu

Cisco Connect 2018 Malaysia - Changing the equation-cybersecurity in digital ...NetworkCollaborators

Ansible Case StudiesGreg DeKoenigsberg

AI saturdays Nigeria Damon Civin

Powering Predictive Mapping at Scale with Spark, Kafka, and Elastic Search wi...Databricks

MAE304-Turners Cloud Archive for CNN's Video Library and Global Multiplatform...Amazon Web Services

Partner Webinar: Mesosphere and DSE: Production-Proven Infrastructure for Fas...DataStax

Airbnb Runs on Amazon Aurora - DAT331 - re:Invent 2017Amazon Web Services

Semelhante a How We Blocked a 650Gb DDoS Attack Over Lunch (20)

D3TLV17- Advanced DDoS Mitigation Techniques

D3TLV17- Keeping it Safe

Cloud Migration with Confidence: 7 Keys to Success

Small Cell Forum: Security Briefing

Journey to the Modern App with Containers, Microservices and Big Data

Powering Predictive Mapping at Scale with Spark, Kafka, and Elastic Search: S...

How to Use the TICK Stack, CoreOS, & Docker to Make Your SaaS Offering Better

The Open Sourcing of Infrastructure

PuppetConf 2017 | Adobe Advertising Cloud: A Lean Puppet Workflow to Support ...

PuppetConf 2017: Adobe Advertising Cloud: Lean Puppet Workflow to Support Mul...

The Stakes Have Changed – The Changing Security Landscape by Tony Teo

A Journey to Modern Apps with Containers, Microservices and Big Data

Cisco Connect 2018 Malaysia - Changing the equation-cybersecurity in digital ...

Ansible Case Studies

AI saturdays Nigeria

Powering Predictive Mapping at Scale with Spark, Kafka, and Elastic Search wi...

MAE304-Turners Cloud Archive for CNN's Video Library and Global Multiplatform...

Partner Webinar: Mesosphere and DSE: Production-Proven Infrastructure for Fas...

Airbnb Runs on Amazon Aurora - DAT331 - re:Invent 2017

Mais de Imperva

Cybersecurity and Healthcare - HIMSS 2018 SurveyImperva

API Security SurveyImperva

Beyond takeover: stories from a hacked accountImperva

Research: From zero to phishing in 60 seconds Imperva

Making Sense of Web Attacks: From Alerts to NarrativesImperva

Survey: Insider Threats and Cyber SecurityImperva

Companies Aware, but Not Prepared for GDPRImperva

Rise of Ransomware Imperva

7 Tips to Protect Your Data from Contractors and Privileged VendorsImperva

SEO Botnet SophisticationImperva

Phishing Made EasyImperva

Imperva 2017 Cyber Threat Defense ReportImperva

Combat Payment Card Attacks with WAF and Threat IntelligenceImperva

HTTP/2: Faster Doesn't Mean Safer, Attack Surface Growing ExponentiallyImperva

Get Going With Your GDPR PlanImperva

Cyber Criminal's Path To Your DataImperva

Combat Today's Threats With A Single Platform For App and Data SecurityImperva

Hacking HTTP/2: New attacks on the Internet’s Next Generation FoundationImperva

Gartner MQ for Web App Firewall WebinarImperva

More Databases. More Hackers. More Audits.Imperva

Mais de Imperva (20)

Cybersecurity and Healthcare - HIMSS 2018 Survey

API Security Survey

Beyond takeover: stories from a hacked account

Research: From zero to phishing in 60 seconds

Making Sense of Web Attacks: From Alerts to Narratives

Survey: Insider Threats and Cyber Security

Companies Aware, but Not Prepared for GDPR

Rise of Ransomware

7 Tips to Protect Your Data from Contractors and Privileged Vendors

SEO Botnet Sophistication

Phishing Made Easy

Imperva 2017 Cyber Threat Defense Report

Combat Payment Card Attacks with WAF and Threat Intelligence

HTTP/2: Faster Doesn't Mean Safer, Attack Surface Growing Exponentially

Get Going With Your GDPR Plan

Cyber Criminal's Path To Your Data

Combat Today's Threats With A Single Platform For App and Data Security

Hacking HTTP/2: New attacks on the Internet’s Next Generation Foundation

Gartner MQ for Web App Firewall Webinar

More Databases. More Hackers. More Audits.

Último

Dev Dives: Streamline document processing with UiPath Studio WebUiPathCommunity

"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...Fwdays

Story boards and shot lists for my a level piececharlottematthew16

From Family Reminiscence to Scholarly Archive .Alan Dix

Scanning the Internet for External Cloud Exposures via SSL CertsRizwan Syed

Advanced Computer Architecture – An IntroductionDilum Bandara

H2O.ai CEO/Founder: Sri Ambati Keynote at Wells Fargo DaySri Ambati

DevoxxFR 2024 Reproducible Builds with Apache MavenHervé Boutemy

WordPress Websites for Engineers: Elevate Your Brandgvaughan

Powerpoint exploring the locations used in television show Time Clashcharlottematthew16

Commit 2024 - Secret Management made easyAlfredo García Lavilla

Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024BookNet Canada

Human Factors of XR: Using Human Factors to Design XR SystemsMark Billinghurst

SAP Build Work Zone - Overview L2-L3.pptxNavinnSomaal

DSPy a system for AI to Write Prompts and Do Fine TuningLars Bell

TeamStation AI System Report LATAM IT Salaries 2024Lonnie McRorey

Leverage Zilliz Serverless - Up to 50X Saving for Your Vector Storage CostZilliz

Unraveling Multimodality with Large Language Models.pdfAlex Barbosa Coqueiro

Merck Moving Beyond Passwords: FIDO Paris Seminar.pptxLoriGlavin3

"ML in Production",Oleksandr BaganFwdays

How We Blocked a 650Gb DDoS Attack Over Lunch

2. © 2017 Imperva, Inc. All rights reserved.2 DDoS Attacks Bigger than ever 2009 2012 2014 2016 100 300 500 700 2017 1,000 60 Gbps 300 Gbps 1 Tbps (Dyn) 600 Gbps (Krebs Blog) Data blast equal to 15 HD movies per SECOND

3. © 2017 Imperva, Inc. All rights reserved. DDoS Mitigation It Takes a Monster 3 • A mighty animal • Something of monstrous size • A Behemoth – Massive throughput – Software intensive – Designed and built by us

6. Confidential6 Throughput Stress test

10. © 2017 Imperva, Inc. All rights reserved. Mitigation by HW Process packets at line rate using software The “brain” detects and applies the right mitigation policy Brain then offloads mitigation to specially designed hardware

14. Confidential14 650Gbps Throughput Hit wave Behemoth Networked Behemoths

15. © 2017 Imperva, Inc. All rights reserved. Layered Network • 20 x Local PoPs – 40G – CDN, small/medium size DDoS – Serve limited regions • 10 x Super PoPs – 500G – Large DDoS – Cover gaps and out of region traffic Confidential15 We Optimize for Both CDN and DDoS Europe Network

16. © 2017 Imperva, Inc. All rights reserved. Want the Full Story? Clear here to read the blog “650Gbps DDoS Attack from the Leet Botnet” https://www.incapsula.com/blog/650gbps-ddos-attack-leet-botnet.html Confidential16

How We Blocked a 650Gb DDoS Attack Over Lunch

Recomendados

Recomendados

Mais conteúdo relacionado

Mais procurados

Mais procurados (7)

Destaque

Destaque (8)

Semelhante a How We Blocked a 650Gb DDoS Attack Over Lunch

Semelhante a How We Blocked a 650Gb DDoS Attack Over Lunch (20)

Mais de Imperva

Mais de Imperva (20)

Último

Último (20)

How We Blocked a 650Gb DDoS Attack Over Lunch