Detecting Asymmetric Application-layer Denial-of-Service Attacks In-Flight with Finelame
summary
Finelame instruments the OS with eBPF probes to map request IDs to processing functions and to account malloc and other resource allocations per request, producing per-request in-flight detection across components and languages. It trains a k‑means fingerprint (K ≈ number of application branches) in userspace, shares centroids to kernel probes using L1 approximations, and flags outliers early (often under 10% of request lifetime, best under 5%). Evaluation shows integration with legacy apps with no code changes and about ~12% latency overhead on Apache.
AI-written summary · about
chapters (7)
- 0:00Start
- 0:20Recap on Denial of Service Attacks
- 6:51Anomaly Detection Engine
- 8:52Implementation Highlights
- 11:19Anomaly Detection
- 13:59Recap
- 15:29True Positive Rate
related talks
20mThink eBPF for Kernel Security Monitoring
32mReal Time Security - eBPF for Preventing attacks
30mLessons From Defending The Indefensible
39mFinding the Needles in a Haystack: Identifying Suspicious Behaviors...
32mActive Fault Finding in Networks
44meBPF as an Active Security Enforcement Layer Stop DNS Data Breaches : Beyond Passive Observability
29mRuntime Security at Scale With EBPF: Hybrid Detection and Root Cause…
15mExtending Applications Safely and Efficiently