In recent years, we have witnessed a new kind of DDoS attack, the burst
attack(Chai, 2013; Dahan, 2018), where the attacker launches periodic bursts of
traffic overload on online targets. Recent work presents a new kind of Burst
attack, the YoYo attack (Bremler-Barr et al., 2017) that operates against the
auto-scaling mechanism of VMs in the cloud. The periodic bursts of traffic
loads cause the auto-scaling mechanism to oscillate between scale-up and
scale-down phases. The auto-scaling mechanism translates the flat DDoS attacks
into Economic Denial of Sustainability attacks (EDoS), where the victim suffers
from economic damage accrued by paying for extra resources required to process
the traffic generated by the attacker. However, it was shown that YoYo attack
also causes significant performance degradation since it takes time to scale-up
VMs. In this research, we analyze the resilience of Kubernetes auto-scaling
against YoYo attacks. As containerized cloud applications using Kubernetes gain
popularity and replace VM-based architecture in recent years. We present
experimental results on Google Cloud Platform, showing that even though the
scale-up time of containers is much lower than VM, Kubernetes is still
vulnerable to the YoYo attack since VMs are still involved. Finally, we
evaluate ML models that can accurately detect YoYo attack on a Kubernetes
cluster.

By admin