A Study On Detection And Mitigation Of Ddos Attacks In Kubernetes Clusters

As organizations continue to move their infrastructure to the cloud, they encounter new challenges in information security, particularly in protecting their clusters from attackers. Additionally, they must ensure the availability of these clusters by safeguarding against ransomware and DDoS attacks. Container orchestration is vital to transitioning to the cloud, and Kubernetes has become the industry standard for container orchestration. With this in mind, securing Kubernetes clusters has become a critical concern. This study aims to broaden the understanding of attack detection and mitigation in Kubernetes environments. To achieve this, I will conduct simulations in a Kubernetes cluster designed to resemble real-world deployments. Monitoring and mitigation tools will be implemented with the aim of exploring ways to secure the environment. A specific DDoS attack known as the YoYo attack will be executed, analyzed, and evaluated. It is a unique and specialised attack against Kubernetes environments targeting specifically autoscaling. It is challenging to detect since it typically does not affect the availability of the service. From the simulations performed, a distinct pattern associated with the YoYo attack was observed. This enabled the creation of a conditional formula, which showed effectiveness in identifying the attack. The key findings in this work show that it is possible to identify YoYo attacks in Kubernetes clusters with open-source applications. This was done by implementing the applications. Finding which metrics to monitor, identifying the patterns during an ongoing attack, and crafting an algorithm to detect when these patterns emerge. Although with our solution, automatic mitigation strategies could not be implemented, a simplified manual version was applied. The results showed success in the identification and mitigation of YoYo attacks.