It never ceases to amaze how creative the criminals that institute Distributed Denial of Service Attacks (DDoS) can get. Gone are the days that a simple Syn Flood attack is all that they will throw at you – now much more complex attack vectors are in play – all designed to use up precious networking and server resources and either bring performance to its knees or perhaps open up some buffer overload attack sequence.
Anti-DDoS engine complexity has increased dramatically in the last decade – now they often include some form of Artificial Intelligence or Machine Learning Algorithms to help spot DDoS attacks, but typically the first and last stages still use Access Control list lookups which can become an overall bottleneck. Allow/Deny Lists can contain tens of millions of rules.
As a packet from a new flow is established it is the responsibility for the Anti-DDoS engine to decide whether to grant entry into the network – to do this it can lookup various information to decide if this flow is from a known bad actor – typically one of the first gates to pass through is the Access Control List (ACL) lookup – these can involve very complex multiple tuple lookups that dive deeply into the packet headers – the term Deep Packet Inspection (DHI) is now being applied to such lookups and is a kindred spirit to Deep Packet Inspection (DPI) that examines the payload of the packet.
Once an AI system decides that a set of header parameters indicates malware it will quickly update the ACL table so that precious AI resources are not wasted.
Strong Security requires that the headers of each packet are examined in real-time, this can use a combination of Exact Match, Longest Prefix Match (LPM) and Access Control List match (ACL).
Depending on the system, the total number of rules, the number of rules that match, the complexity of the rules and the speed of the searches (Millions of searches per sec) determine the overall performance level.
Meeting the search requirements can be accomplished in several ways:
The MoSys Stellar Packet Classification Platform – High Flexibility/High Complexity ACL & LPM Edition is
provided as Intellectual Property (IP) that uses a hardware accelerated Algorithmic TCAM-like approach to
help ensure that Anti-DDoS engines can keep up with the huge volume of access control decisions per
second that it has to process.
The PHE features four levels of memory, 32 Risc core processors to perform user-programmed In-Memory Functions (IMFs), along with all of the fixed BURST and RMW functions included in the BE3 products. We combine this with our high-speed serial protocol I/O interface to enable your applications to achieve hyperspeed performance.
Read more