As the complexity of distributed denial of service (DDoS) attacks continues to grow, there is a corresponding need to build increasingly sophisticated systems to defend organizations.

That's the direction Netscout is taking with the latest update to its Arbor Edge Defense (AED) platform, which integrates machine learning (ML) techniques. The AED platform is deployed at the network edge in front of a firewall, helping to identify potential risks and defend against advanced DDoS attacks with a combination of ML smarts and Netscout's threat intelligence capabilities.

Tom Bienkowski, director of product marketing at Netscout, told SDxCentral that the latest version of AED integrates the company’s ATLAS Intelligence Feed. ATLAS receives its intelligence from more than 400 Tb/s of international transit traffic received every second of every day from 93 countries, 600 industry verticals, and more than 31,000 autonomous systems. Bienkowski added that ATLAS constantly updates the IP addresses of bots and amplifiers actively participating in DDoS attacks around the globe.

"Using this data, Netscout's expert security research and DDoS attack mitigation team, ASERT, has helped train the machine learning models now integrated into AED to detect and stop attacks automatically, just like they would if managing the response personally," Bienkowski said.

The latest AED update isn't Netscout's first experience with machine learning.

Bienkowski said ML has found its way into Netscout's platforms in different ways in the past. For example, AED conducts automated deep packet inspection, in real time, using Netscout's ATLAS Threat Intelligence to look for known characteristics of DDoS attacks, such as specific signatures of DDoS attack tools and services.

AED also uses ML to build a model of normal network traffic on a per-network segment and per-protocol basis. From this model, a baseline is established. Bienkowski said that using statistical analysis and other proprietary algorithms, DDoS attacks are automatically detected, and attack countermeasures are automatically applied to mitigate.

With the new release, Netscout has expanded its use of ML. Bienkowski said that as attacks are being mitigated in real time, additional deep packet inspection is being conducted.

"From this analysis, which is based upon the real-world experience of our ASERT team, additional countermeasure configurations are recommended, enabling the customer to fine-tune attack mitigation as attack traffic dynamically changes," Bienkowski said. "This is what we mean by adaptive DDoS protection."

In recent DDoS threat reports from Netscout, the company has seen a shift in how threat actors execute DDoS attacks over the last two years.

For example, Bienkowski said Netscout has seen extensive reconnaissance of target organizations prior to attacks. Threat actors often start attacks by probing defenses and watching for signs of how effective preliminary attacks are. If one type of attack is shown to be easily mitigated, they will quickly switch methodologies or threat vectors until they are successful. Likewise, this probing may be spread out over several hours or days.

According to a recent Netscout DDoS Threat Intelligence Report, multivector attacks comprised more than 40% of all DDoS attacks in 2022, and more than a quarter million of those attacks used more than 10 vectors.

"We call these dynamic DDoS attacks because they change gears frequently and in real time, making it difficult for organizations to defend themselves," Bienkowski said.

He also noted that many dynamic DDoS attacks are not huge, volumetric attacks. They may use lower levels of bandwidth to attack the application layer, helping them avoid DDoS defenses at the ISP level.

AED previously relied on predetermined lists and settings determined by an organization’s IT or networking teams to block incoming traffic. Bienkowski said now these groups can also configure the system to automatically erect new defenses in real time based on ML-generated recommendations.

"In initial testing, we’ve seen that AED’s adaptive DDoS defense measures can help identify and stop up to 90% of DDoS attacks," he said. "Of course, attackers will continue to innovate new methodologies to get around adaptive defenses and this is something that we’re closely monitoring."