00:00:00.375-->00:00:06.000
>>Cool. So, hi DefCon. Um, I’m
Redezem. Uh, don’t ask about the
name it involves an, eh,

00:00:06.000-->00:00:11.375
incident with a Caesar cypher
and a preschool. Um, welcome to
PEIMA DefCon addition where

00:00:11.375-->00:00:15.875
we’re going to talk about how to
break denial of service attacks
and, uh, do anomolated action on

00:00:15.875-->00:00:22.500
the cheap. Um, this is mostly a
defense talk, so no cool
exploits. Sorry. Um, but, uh,

00:00:22.500-->00:00:27.583
there is a lot we can play
around with here and if you like
hacking, this is probably for

00:00:27.583-->00:00:33.833
you. Alright, so who am I? My
real name is Stefan. I am, uh,
by most accounts a Phd student.

00:00:33.833-->00:00:39.333
I live in the beach and
sunshiney wastes of Perth,
Western Australia which is about

00:00:39.333-->00:00:44.125
28 hours worth of flying time
from here. Um, the bonus is that
the weather is basically the

00:00:44.125-->00:00:49.208
same over there in summer so I
mean, the heat’s been kind of
meh. Um, now I’m a network kind

00:00:49.208-->00:00:54.167
of guy. I love my networks and
network security. I work in
research with Curtin University.

00:00:54.167-->00:00:59.792
That’s the first logo in case
you were confused. Um, I also
work with a company called ES2

00:00:59.792-->00:01:03.708
which let’s me do my hacking
stuff. They’re the second logo.
They’re some great guys. If

00:01:03.708-->00:01:08.333
you’re in the Perth region, call
them up. They’re lots of fun to
hang with. Uh, cool. So what are

00:01:08.333-->00:01:13.167
we talking about today? We’re
talking about how you can use
power laws to protect your stuff

00:01:13.167-->00:01:18.167
basically. Um, in short this is
anomaly detection without any
sort of AI whatsoever. >>Woo!

00:01:20.417-->00:01:26.667
>>Um, it’s pretty great. So, um,
we’re going to have a look at
what they are. How they work.

00:01:26.667-->00:01:30.458
What I’ve been using them for,
which is denial of service
detect- um, defense. Uh, and,

00:01:30.458-->00:01:35.167
uh, we’re going to look at what
the research shows is possible
and consequentially where your

00:01:35.167-->00:01:39.875
hacking efforts would be really,
really useful and probably get
you some serious cred. Um, and

00:01:39.875-->00:01:43.792
then I’ll release a neat tool to
get you on your way and a demo
that can show you what you can

00:01:43.792-->00:01:50.458
actually do with it if you work
with it. So power laws, or most
honestly, power law probability

00:01:50.458-->00:01:54.583
distributions, which is a
mouthful so nobody’s got time
for that. Um, basically they’re

00:01:54.583-->00:02:00.167
are natural processes out there
in nature. Earthquakes, light
from stars, mutation in DNA,

00:02:00.167-->00:02:06.375
y’know, language, that sort of
thing. Um, the things that are
descriptive of these things tend

00:02:06.375-->00:02:11.542
to follow these things called
power law distributions which is
the second graph over there. Uh,

00:02:11.542-->00:02:17.042
there kind- there are a couple
of popular ones. The well known,
relatively speaking, uh, V

00:02:17.042-->00:02:19.875
Source did a great video on
Zipf’s Law that you should
totally watch if you’re

00:02:19.875-->00:02:24.125
interested in this sort of
thing. Um, but yes. So Zipf’s
Law basically says if you’ve

00:02:24.125-->00:02:28.125
got, ‘cause language is a
natural process, if you take a
book and count all of the words

00:02:28.125-->00:02:32.292
in the book, the second most
popular word will appear about
half as much as the first most,

00:02:32.292-->00:02:36.250
and the third most popular word
appears about a third much as
the first most, and so on and so

00:02:36.250-->00:02:40.708
forth. And it’s really weird
because it works in every single
language, in every single book,

00:02:40.708-->00:02:45.833
period. Which is bizarre. We
have no idea why. Um, this also
works for financial

00:02:45.833-->00:02:50.833
transactions. You can use this,
uh, to detect fraud because
funnily enough, when something

00:02:50.833-->00:02:55.000
should be following a power law
and isn’t, something’s wrong and
it’s very, very sensitive to

00:02:55.000-->00:02:58.542
that. So banks have been using
this for ages and we’ve only
started using this is, um,

00:02:58.542-->00:03:04.000
network security in the last
year. So what does that mean for
us? Well basically network

00:03:04.000-->00:03:10.000
traffic is somehow natural,
which means that Skynet is real,
the singularity is here, uh,

00:03:10.000-->00:03:16.292
Elon Musk was right, and we’re
all gonna die. Seriously though,
um, it just means we can apply

00:03:16.292-->00:03:20.167
power laws to it to do anomaly
detection without any sort of AI
to it because what we do know

00:03:20.167-->00:03:24.542
is, under normal circumstances,
it should follow one of these
power laws. Things should follow

00:03:24.542-->00:03:28.750
a power laws in network
detection and if they don’t, we
already know that something is

00:03:28.750-->00:03:34.875
wrong. Cool. The neat bit about
this for pat- for denial of
service attacks is, thanks to

00:03:34.875-->00:03:38.292
the nature of denial of service
attacks wanting to, or
specifically flood based denial

00:03:38.292-->00:03:43.042
service attacks, wanting to
overwhelm the network, you can’t
actually do one without breaking

00:03:43.042-->00:03:49.667
a power law, so I will know
you’re doing it. Cool, so, um,
basically we don’t have to teach

00:03:49.667-->00:03:54.708
a computer what normal is
anymore so no AI. Great stuff.
Uh, the cool one is Benford’s

00:03:54.708-->00:03:59.250
Law which you hard code because
it never changes. Uh, basically
if you have a number that’s long

00:03:59.250-->00:04:04.250
enough, say the amount of time
in milliseconds between any two
packets arriving on a system,

00:04:04.250-->00:04:07.917
um, we know that the probability
that the first digit is one is
about thirty percent. We

00:04:07.917-->00:04:11.125
actually know what the
probability for all digits in
that number being any given

00:04:11.125-->00:04:15.667
number is, which is great and
conveniently the whole thing
never changes so you can just

00:04:15.667-->00:04:20.208
hard code it and away you go.
What could we do with that?
Well, I’ve been beating denial

00:04:20.208-->00:04:25.833
of service with it for the last
six months. Um, basically flood
based denial of service attacks.

00:04:25.833-->00:04:30.167
Amplification attacks are
particularly good. Uh, y'know,
the sort of things that the

00:04:30.167-->00:04:35.792
internet of things uh, is likely
to cause more of as there are
more of these ridiculously

00:04:35.792-->00:04:40.333
insecure devices enter the
internet. So, um, basically in
this graph here you can see ten

00:04:40.333-->00:04:44.167
separate denial of service
attacks. One after the other.
It’s actually on a network where

00:04:44.167-->00:04:47.375
we’ve got a bunch of gamers
playing Unreal Tournament 99 and
someone’s trying to stop them

00:04:47.375-->00:04:52.167
from winning because, y'know, we
like blasts from the past and
whatnot. Um, so the higher that

00:04:52.167-->00:04:56.500
number, so the higher that line
goes, the worse it’s error from
Benford’s Law is and you can

00:04:56.500-->00:04:59.625
easily see when your denial of
service happens. This is a
single machine. You throw in

00:04:59.625-->00:05:03.625
more machines in there, you make
it a larger attack, it becomes
more ridiculous. Uh, it’s

00:05:03.625-->00:05:08.375
practically instantaneous too.
Uh, each data point in that
graph represents about a- a

00:05:08.375-->00:05:12.208
thousand packets, a window about
a thousand packets in length
with takes, y'know, a couple

00:05:12.208-->00:05:16.125
milliseconds to appear. So we
know about an attack starting
and stopping within milliseconds

00:05:16.125-->00:05:21.167
of it happening. . Uh, and I’ve
seen it work in real time in
gigabit scenarios and it’s

00:05:21.167-->00:05:26.333
likely it’s capable of going
even faster so you can do some
really cool stuff with this. Uh,

00:05:26.333-->00:05:29.792
again it detects this without
any training whatsoever. I
didn’t have to train anything I

00:05:29.792-->00:05:33.458
just said “when the number is
greater than zero point five,
tell me a denial of service

00:05:33.458-->00:05:38.375
attack is happening” and it’s
pretty much always accurate. So
how do we do it? Well, it’s

00:05:38.375-->00:05:43.500
really, really cheap. We get
ourselves a TCP dump, so really
complex piece of software. Uh,

00:05:43.500-->00:05:47.750
we get it to dump in dash NN so
just you want to get the headers
and none of that cool, y’know,

00:05:47.750-->00:05:53.458
resolving thing. We extract
features, namely the length and
what their timestamp is. Uh, we

00:05:53.458-->00:05:57.667
check how well those features
fit power laws by our goodness
of fit function. Uh, if you want

00:05:57.667-->00:06:01.708
to investigate more of these
please look at the code in the
dem- in the demo I’m gonna be-

00:06:01.708-->00:06:06.917
uh, in the tool I’m gonna be
releasing. Uh, you print out the
result to a CSV and thrown an

00:06:06.917-->00:06:12.750
alarm or something. And, I mean,
this works with any subset of
traffic data so you can actually

00:06:12.750-->00:06:17.167
narrow this down by excluding-
excluding the people you know
are good until eventually you

00:06:17.167-->00:06:20.625
figure out exactly who the
people that are, y’know, denial
of servicing you and you can

00:06:20.625-->00:06:25.875
probably, like, change your IP
tables at that point to drop
their packets. So what can you

00:06:25.875-->00:06:29.792
do? Well, unless you're a really
big company this probably won’t
save your network because if

00:06:29.792-->00:06:34.167
someone wants to, uh, distribute
a denial of service attack,
y’know, we saw with Krebs uh,

00:06:34.167-->00:06:39.958
600 gigabits a second - I’m not
entirely sure your router can
deal with that. Um, but what you

00:06:39.958-->00:06:42.958
can do is you can look for
attacks and you can tell where
they’re coming from. So you can

00:06:42.958-->00:06:48.458
report to your ISP and say “Hey.
I’m being denial of serviced by
these people” and that makes

00:06:48.458-->00:06:53.083
their life a lot easier. Um, you
can actually invert this too and
look at your own network. So you

00:06:53.083-->00:06:57.667
can turn around and say “hey, my
laptop is sending out a denial
of service attack. Who the heck

00:06:57.667-->00:07:02.458
has owned my laptop?” Um, which
is great because that probably
means you’re part of a botnet

00:07:02.458-->00:07:07.083
and you want to go ahead and
flash that thing. Alright, so
what else can you do? Well,

00:07:07.083-->00:07:11.750
research. We can see that, um,
you can actually see more than
just denial of service because

00:07:11.750-->00:07:15.792
obviously that’s not the only
disturbance on a network. You
can see some attacks. Now the

00:07:15.792-->00:07:20.417
attacks we have seen so far are
end map and some, uh, buffer
overload style attacks

00:07:20.417-->00:07:24.458
specifically for NGINX. You can
see them happening but that’s
because I'm not doing anything

00:07:24.458-->00:07:28.042
smart with my detection. I’m
literally drawing a line and
saying “if it’s above that,

00:07:28.042-->00:07:32.792
there’s something wrong.” Um,
you can actually probably train
something to figure out the

00:07:32.792-->00:07:35.958
shapes of each of these attacks
because each spike looks
slightly different. That one

00:07:35.958-->00:07:41.583
there is an end map port scan,
um, so not using the, uh, end
map scripting engine. So um,

00:07:41.583-->00:07:46.667
yeah, you can tell that trained
thing to make decisions for you
and yeah, it’s- it’s- it’s

00:07:46.667-->00:07:51.417
pretty cool. We don’t know
exactly what limit of the
threats are that you can detect

00:07:51.417-->00:07:56.167
and pretty much anything that
happens will change how your
network works and power laws are

00:07:56.167-->00:08:00.792
really good at picking up that.
So, um, some disturbances aren’t
attacks. Uh, power laws are

00:08:00.792-->00:08:04.375
really good at telling when that
underlying process that’s
creating your traffic changes.

00:08:04.375-->00:08:07.875
Uh, in this graph, uh, here
there’s actually some kind of
anomaly. Sure, there’s some

00:08:07.875-->00:08:12.375
spikes there but the one we’re
actually looking at here is the
big bump in the middle of it.

00:08:12.375-->00:08:16.750
That’s actually when everyone
starts logging in at 6 AM in the
morning. We can actually tell

00:08:16.750-->00:08:23.375
when people start logging in
just by looking at the Benford’s
Law compliance of the data. It’s

00:08:23.375-->00:08:27.417
pretty cool. So basically if you
see a change that isn’t regular
and doesn’t match with any of

00:08:27.417-->00:08:31.667
your activities, you might see
someone doing something to your
network, doing something to one

00:08:31.667-->00:08:36.667
of your computers, or something
is broken. And that’s pretty
helpful too I guess. However,

00:08:39.292-->00:08:44.042
that’s not the only things we
can look for changes in. We can
look for changes in your user.

00:08:44.042-->00:08:48.667
You see, uh, humans are pretty
natural, right? Yknow, language
is natural. Finances are

00:08:48.667-->00:08:54.000
natural. They’re both done by
humans. Well, turns out users
interacting with keyboards is

00:08:54.000-->00:08:59.250
also pretty natural in terms of
process. Um, we’ve actually seen
in research that you could turn

00:08:59.250-->00:09:04.042
around and take the time between
each, well, between each key
press you make and that actually

00:09:04.042-->00:09:10.125
conforms with Zipfs Law, y’know,
the law that actually, y'know,
language conforms with. So, um,

00:09:10.125-->00:09:14.875
whenever you actually change
user, the error slightly
changes. If you, instead of

00:09:14.875-->00:09:20.500
looking at how well it conforms
with Benford’s law, you look at
the difference between the

00:09:20.500-->00:09:25.583
actual law itself and what you
do. So, what the errors are
individually, and you save that

00:09:25.583-->00:09:29.917
as a profile. Whenever you're
using the computer you’ll be
around about that profile, and

00:09:29.917-->00:09:33.833
whenever someone else uses your
computer, they’ll be completely
different and you can

00:09:33.833-->00:09:38.625
immediately tell that someone
is- is using your computer and
you didn’t ask them to. So,

00:09:38.625-->00:09:43.750
keyboards are great and all but
that’s not the only thing you
can do because it’s entirely

00:09:43.750-->00:09:48.333
based on human interaction you
can probably extend this to all
sorts of stuff. Command usage,

00:09:48.333-->00:09:53.458
network usage for that user, et
cetera, et cetera. So when your
computer determines that

00:09:53.458-->00:09:59.042
something is up here you can
turn around and tell it to start
doing stuff. You can say “oh,

00:09:59.042-->00:10:04.833
I’d better start a keylogger, or
start sandboxing things, denying
access to things.” Whatever. Be

00:10:04.833-->00:10:10.083
creative. Speaking of being
creative, we have no idea where
this goes. This has been looked

00:10:10.083-->00:10:13.708
into for the last six months by
research teams who are
notoriously slow. So hacking

00:10:13.708-->00:10:18.750
input is great and that’s what
I’ve been doing with the denial
of service thing and that’s

00:10:18.750-->00:10:23.833
pretty much the furthest we’ve
gotten. So the tool I’m handing
out today is basically a “here’s

00:10:23.833-->00:10:29.292
basically where I’m up to.” This
is how you can do some power law
analysis. Start putting stuff in

00:10:29.292-->00:10:33.792
and see what you get. It’s
everywhere. There’s a lot of
stuff this can be applied to. We

00:10:33.792-->00:10:38.333
don’t even know the limits of
the network detection capacity.
And we think we can apply it to

00:10:38.333-->00:10:42.750
pretty much anything that has to
do with a computer. So, this
might be really, really cool if

00:10:42.750-->00:10:46.458
you’re an engineer wanting to
play around with something. And
it’s basically really fast and

00:10:46.458-->00:10:51.458
simple to play around with
anyways, so why not? So now the
tool. So bare with me here. Oh.

00:10:57.458-->00:11:02.458
Whoa. No. [laughter and noises
from audience] Come back screen!
[laughter] Hey, AV guys. I can’t

00:11:07.708-->00:11:12.708
do a demo when, uh, the screen’s
blank. Can you help, please?
Please? Well, while that’s

00:11:19.583-->00:11:24.375
happening I’ll set this up so
we’ll just jump straight into
it, right? I think that- I think

00:11:24.375-->00:11:29.375
that’s fair enough. >>Can you
answer questions for a second?
>>Yeah, sure. Sure. Um. >>So if

00:11:32.208-->00:11:37.208
I’m looking at data that
doesn’t- isn’t really natural is
this still, like, maybe an

00:11:39.583-->00:11:44.583
interesting metric to look at?
>>Oh, yeah, sure. No. ‘Cause the
human data right? With keyboard

00:11:47.417-->00:11:51.750
stuff. Um, question being,
y'know, is this a good thing to
look at with stuff that isn’t

00:11:51.750-->00:11:55.917
natural? Uh, human keyboard
data. They figured out you can
actually do profiling just based

00:11:55.917-->00:12:01.167
on the, um, the Benford’s Law.
Which doesn’t conform with
keyboards at all, right? So it’s

00:12:01.167-->00:12:06.167
completely erroneous, but the
profile of error from the user
was actually able to be used as

00:12:08.708-->00:12:13.708
a profile just as well as the
Zipf’s Law stuff. So, even if
something isn’t natural, yeah,

00:12:16.000-->00:12:21.000
there are things you can do with
this. It’s- it’s really, really
good at telling when something

00:12:23.333-->00:12:30.208
has been changed. So. >>We lost
your signal. >>Oh really? Well,
that’s odd. It’s plugged in.

00:12:30.208-->00:12:36.667
>>[inaudible off mic from AV
team] >>Well. Unplug, and we’ll
plug it back in. >>[inaudible

00:12:36.667-->00:12:42.667
off mic from AV team] >>No. No.
Same operating system. >>Second
question. >>Yup. >>[inaudible

00:12:42.667-->00:12:47.375
question from audience] >>Taken
out themselves? >>[more
inaudible from audience] >>They

00:12:47.375-->00:12:53.833
probably... >>Repeat the
question! >>Sorry! Um, has- is
there a- is there a history of

00:12:53.833-->00:12:58.833
banks being taken offline for
four or five hours by denial of
service attacks? Maybe? I’m not

00:13:01.167-->00:13:06.750
exactly sure. I’m pretty sure
that’s happened before.
>>[inaudible off mic] >>Oh, well

00:13:06.750-->00:13:13.667
there you go. [laughter] I mean,
you know. I mean, you know.
Like, the important thing here

00:13:13.667-->00:13:17.792
is that, um, y'know distributed
denial of service attacks,
specifically ones that you would

00:13:17.792-->00:13:23.125
expect from, um, your, uh, your
internet of things devices are
going to get, like,

00:13:23.125-->00:13:27.833
significantly more common over
the next ten to twenty years.
>>Sorry, we’re just resetting.

00:13:27.833-->00:13:33.833
>>Yup. >>So what’s the on the
overhead on running these
calculations? Obviously, you

00:13:33.833-->00:13:38.833
said you can handle a lot of
data really fast, but if you
wanted to say, look at

00:13:42.125-->00:13:48.583
particular IP addresses inside
the network to determine who’s
actually sending the denial of

00:13:48.583-->00:13:53.583
service out >>Yup. >>Like,
what’s the O of N? >>Okay, so
what’s the O of N on the actual,

00:13:57.375-->00:14:02.375
uh, detections... I am pretty
sure it’s O N squared. So it’s
not- it’s not slow, like super

00:14:05.667-->00:14:10.667
slow, but it’s not ultra, ultra
fast. I mean, that’s mostly due
to my tool being pretty d**n

00:14:13.958-->00:14:18.958
slow. You can probably make this
a lot faster. I mean, I’ve
written the tool in basically

00:14:21.792-->00:14:27.333
Python so. >>Perfect. >>Python 2
rules. Screw Python 3.
[laughter] >>Another question.

00:14:27.333-->00:14:33.333
>>Yes. >>[inaudible off mic
question] >>Showing drops in
traffic. Oh. >>[off mic question

00:14:33.333-->00:14:39.333
continues] >>Different Yeah,
yeah, yeah. >>[inaudible off
mic] >>No, it wasn’t on the

00:14:39.333-->00:14:44.333
presentation. >>Can you pull
your presentation back up? >>Oh,
sure. Sure, sure, sure. Okay, so

00:14:46.625-->00:14:51.625
if I put this back up. >>For
some reason it doesn’t like
this. >>Okay, so we can do the

00:14:55.583-->00:15:00.583
presentation bit but we can’t do
the okay, cool. Alright, let’s
see. Uh, duplicate. Ah, thank

00:15:03.833-->00:15:08.833
God for that. Thank you guys.
The AV team everyone! [applause]
Alright, alright. So, the demo

00:15:13.167-->00:15:18.208
right? Uh, it’s sitting on
bitbucket because I’m a terrible
person and I like Mercurial. Um,

00:15:18.208-->00:15:23.542
cool. The address is on the
slides, y'know, take a shot when
I switch back to the, um, to the

00:15:23.542-->00:15:28.542
slides. But basically, uh,
y'know, here we’ve got, uh, your
typical, y’know, end map

00:15:32.375-->00:15:37.375
outpoint. Um, you cat that into
the preprocessor. It’ll strip
out, uh, timestamps, uh, IP

00:15:45.125-->00:15:50.708
addresses, ports from and to,
and a bunch of links and the IP
flags. So if you’re interested

00:15:50.708-->00:15:55.042
in that sort of thing. Y’know.
Obviously these aren’t all used
for my, um, for the analysis and

00:15:55.042-->00:15:58.750
the tool itself but they
basically give you some really,
really quick extensibility

00:15:58.750-->00:16:03.750
options. Um, and if you then
pipe that to the power, uh, law
processor and give it say

00:16:06.833-->00:16:11.833
Benford‘s full enter arrival
time, y’know, with a nice little
CSV of all of the, uh, goodness

00:16:14.375-->00:16:20.750
of fit values and their
timestamps which if you then run
against, uh, so we’ve got- we’ve

00:16:20.750-->00:16:24.833
got,uh, one that I’ve prepared
earlier because, y'know, that’s-
that’s nice of me. Um. Uh. Yup.

00:16:24.833-->00:16:29.833
Um, if you then go Python plot
code plot, uh, output... dun duh
duh dun duh duh duh. If we pop

00:16:42.375-->00:16:48.500
over to here. Hey. Presto! You
can see when a denial of service
attack is happening. Of course

00:16:48.500-->00:16:52.583
that’s me being human and
looking but again if you draw a
line above point zero five you’d

00:16:52.583-->00:16:57.500
be going “Hey. Something’s gone
wrong” as a program. Um, so. Duh
duh duh duh duh duh duh. Take a

00:16:57.500-->00:17:02.500
shot of, oh, shoot. That’s not
what I wanted. D**n you
Microsoft! Alright, cool. So

00:17:06.792-->00:17:11.792
there you go. Um, right there.
Grab a shot of that. Whoa. Oh
no. It ju-ju-just. It just

00:17:18.000-->00:17:21.958
crashed. Alright, alright,
alright. Can you get- did
everyone get that? [laughter]

00:17:21.958-->00:17:26.958
Okay, okay, okay. Okay. Let’s-
let’s try that again. Please
Microsoft. Hey. I’m not- I’m not

00:17:30.625-->00:17:37.500
going to click it. Just, just
take a shot, alright? Um, my
email will be at the end slide,

00:17:37.500-->00:17:43.042
y'know, take a- take a shot of
that too. Okay, so last things
last. Last thing to do. Magic

00:17:43.042-->00:17:46.667
trick. We’re going to do some
Unreal Tournament denial of
service direct in line

00:17:46.667-->00:17:53.083
mitigation without knowing
anything about the attacker. Um.
We cool doing that or? >>You got

00:17:53.083-->00:17:57.583
one minute. >>Okay cool. One
minute. Um, cool so. We got the
server with a- with a, um, user

00:17:57.583-->00:18:04.333
in a server,, We got a user. We
got, um, Kali. I will jump to
the fun part of this because I

00:18:04.333-->00:18:11.083
do not have much time. Thank you
AV screwy things. Alright, cool.
Okay, so here we got the guy up

00:18:11.083-->00:18:17.750
top here. This is the server.
We’ve got- Oh s**t. It’s gone
and done that thing where it’s,

00:18:17.750-->00:18:22.750
uh, stopped extending. Alright.
Alright, alright, alright. Cool.
There we go. Can we see it now?

00:18:25.125-->00:18:28.292
Alright, alright, alright. This
guy is the server. This guy is
the player. This guy is our

00:18:28.292-->00:18:32.875
really nice secret project, uh,
filter in the middle and the
gateway and this is Cali. If I

00:18:32.875-->00:18:37.875
jump ahead, uh, if I jump ahead
here. Uh, we can see I’m doing
HPing to launch an attack.

00:18:40.167-->00:18:46.542
Alright. Uh, the filter detects
it. Uh, wait for it. Alright, so
the filter’s detected it and

00:18:46.542-->00:18:49.417
it’s currently actively
mitigating the attack. It is
looking at individual packets

00:18:49.417-->00:18:52.875
and determining whether or not
they are denial of service
packets. It is not determining

00:18:52.875-->00:18:56.875
whether or not the, uh, machine
that is attacking it is actually
a bad guy. As you can see,

00:18:56.875-->00:19:01.167
there’s no lag. If I jump a bit
forward I can actu- I’ve
actually turned it off. Uh, here

00:19:01.167-->00:19:06.875
we go. And as you can see, the,
uh, player can no longer play.
There’s a big jump in traffic on

00:19:06.875-->00:19:12.708
the server. Uh, if we jump over
to here. Yeah. You can see up
the top there that we are now

00:19:12.708-->00:19:17.292
seriously lagging because again
there actually is a denial of
service attack on. So that’s

00:19:17.292-->00:19:22.750
without the filter. And if we
jump forward again, um, and we
switch it back on. There you go.

00:19:22.750-->00:19:27.750
Um, so you can see that the, uh,
the traffic has dropped again.
The thing can detect an attack.

00:19:29.917-->00:19:35.333
It is currently mitigating. And
yeah. There’s no- there’s no
lag. So we’ve successfully used

00:19:35.333-->00:19:40.333
this to directly inline mitigate
a denial of service attack. So
that is it. Thank you very much.

00:19:44.833-->00:19:46.458
[applause]