• L3 - spoofed IP packets • source IP addresses are fake • very large • this is what you hear in news • L7 - fully established TCP connections • IP reputation is effective 7 Two DoS types
• EWMA - Exponentially weighted moving average • Counting rates of packets • Space saving • Known as Top-N or Heavy Hitters • Simplified hierarchical heavy hitters • Hyper log log • Cardinality estimation - Counting unique things 13 Streaming algorithms
• Smoothed average • The same maths as Linux "load average" • Charges slow (half-life) • Discharges quickly • Can be also used to count rates of packets 25 EWMA - summary
• aka: heavy hitters • A fixed-memory data structure • That can "count" top-N items • think: top url's, top customer IP's, etc • Count-Min sketch, Space Saving 28 Top-N problem
• Attack detection is a streaming problem • Streaming algorithms are awesome • Applicable to many more problems 60 Summary Thanks! [email protected]flare.com