Entropy-based detection of denial of wallet attacks in serverless architectures
摘要
In serverless architectures, applications are executed in environments where resources are dynamically allocated according to demand. Instead of having dedicated servers, functions are executed in response to specific events, allowing for high scalability and simplified infrastructure management. However, the lack of resources to monitor and protect these architectures makes them a ripe target for attackers. Denial of Wallet (DoW) attack is a term used to describe a situation in which an organization incurs financial losses by exceeding the service quota limits contracted with a cloud platform. The objective of this study is to detect Denial of Wallet (DoW) attacks using the concept of entropy. Entropy refers to the measure of uncertainty in a dataset and can be used as a metric to identify anomalous patterns. In this context, this study proposes an approach based on calculating the entropy of various features of executing serverless functions, including the number of invocations, and memory and CPU consumption. By applying this approach, it is expected to improve early detection of DoW attacks and reduce false negatives. By leveraging entropy as a measure of randomness in serverless function call data, an additional tool is provided to strengthen network security and mitigate the negative effects of denial-of-service and denial-of-wallet (DoW) attacks.