Kubernetes Autoscaling: YoYo Attack Vulnerability and Mitigation

Ronen Ben David, Anat Bremler-Barr

2021

Abstract

In recent years, we have witnessed a new kind of DDoS attack, the burst attack(Chai, 2013; Dahan, 2018), where the attacker launches periodic bursts of traffic overload on online targets. Recent work presents a new kind of Burst attack, the YoYo attack (Bremler-Barr et al., 2017) that operates against the auto-scaling mechanism of VMs in the cloud. The periodic bursts of traffic loads cause the auto-scaling mechanism to oscillate between scale-up and scale-down phases. The auto-scaling mechanism translates the flat DDoS attacks into Economic Denial of Sustainability attacks (EDoS), where the victim suffers from economic damage accrued by paying for extra resources required to process the traffic generated by the attacker. However, it was shown that YoYo attack also causes significant performance degradation since it takes time to scale-up VMs. In this research, we analyze the resilience of Kubernetes auto-scaling against YoYo attacks. As containerized cloud applications using Kubernetes gain popularity and replace VM-based architecture in recent years. We present experimental results on Google Cloud Platform, showing that even though the scale-up time of containers is much lower than VM, Kubernetes is still vulnerable to the YoYo attack since VMs are still involved. Finally, we evaluate ML models that can accurately detect YoYo attack on a Kubernetes cluster.

Paper Citation

in Harvard Style

Ben David R. and Bremler-Barr A. (2021). Kubernetes Autoscaling: YoYo Attack Vulnerability and Mitigation. In Proceedings of the 11th International Conference on Cloud Computing and Services Science - Volume 1: CLOSER, ISBN 978-989-758-510-4, pages 34-44. DOI: 10.5220/0010397900340044

in Bibtex Style

@conference{closer21,
author={Ronen Ben David and Anat Bremler-Barr},
title={Kubernetes Autoscaling: YoYo Attack Vulnerability and Mitigation},
booktitle={Proceedings of the 11th International Conference on Cloud Computing and Services Science - Volume 1: CLOSER,},
year={2021},
pages={34-44},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0010397900340044},
isbn={978-989-758-510-4},
}

in EndNote Style

TY - CONF

JO - Proceedings of the 11th International Conference on Cloud Computing and Services Science - Volume 1: CLOSER,
TI - Kubernetes Autoscaling: YoYo Attack Vulnerability and Mitigation
SN - 978-989-758-510-4
AU - Ben David R.
AU - Bremler-Barr A.
PY - 2021
SP - 34
EP - 44
DO - 10.5220/0010397900340044