Defense Against Rapidly Morphing DDOS
summary
Built an attack toolkit called soda that reproduces the ProtonMail incident and a containerized lab for safe Red Team testing, the team runs continuous morphing floods and application floods and shows standard human-led mitigation is too slow. A two-stage ML approach pairs an anomaly detector with a supervising health metric so mitigations trigger only when user-facing service degrades; detections take seconds, network vs application signatures differ, and soda plus the blueprint are being open-sourced for reproducible posture tests.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 0:15The younger generation
- 0:35DDoS services
- 0:45Cost of DDoS
- 1:22Who are the Busters
- 2:40ProtonMail Attack
- 9:15Mitigation
- 9:38Anomaly Detection
- 18:35One Piece of Advice
- 20:23Intelligent Mitigation
- 23:47Soda
- 24:17Machine Learning
- 28:23Questions
related talks
37mAnatomy of a DDoS
13mDDoS emotions
45mAnatomy of a DDoS
37mAutomation Tactics for Modern Threat Emulation
12mMulti-Layer Defense for Scalable Threat Mitigation
46mDeception Is on the Rise, But Is It Time to Unleash Engagement Operations?
52mInvestigating DDOS - Architecture Actors and Attribution
45mFast, Ever-Evolving Defenders: The Resilience Revolution