topic Re: SPL to check for timing attacks in Splunk Enterprise Security

SPL to check for timing attacks

jogonz20 — Sun, 06 Dec 2020 17:35:20 GMT

Hello fellow splunkers,

I would like to know if someone has come across a way to determine via a splunk query timing attacks, I have read some posts on github pointing out to useful information but still nothing concrete.

I know we could do something with machine learning but not sure how to deal with it deeply in order to check for so.

Thanks so much,

Re: SPL to check for timing attacks

richgalloway — Sun, 06 Dec 2020 21:41:07 GMT

Please explain your use case. What is a "timing attack"? How would you detect one?

Re: SPL to check for timing attacks

sduff_splunk — Sun, 06 Dec 2020 22:28:13 GMT

You may find that ML is overkill for this particular use-case.

Consider Apache web logs, for example, which can be configured to include the RequestTimeSeconds, which is the time taken to process a request.

You could then create an alert with something like the following:

index=weblogs earliest=-30m@m | eventstats count, avg(RequestTimeSeconds) as avg_rts, stdev(RequestTimeSeconds) as stdev_rts by url | where RequestTimeSeconds>(2*stdev_avg+avg_rts) AND count>10

This will give you a list of URLs that have been accessed more than 10 times, and have occurrences where the time to respond has been over 2 standard deviations above the average (per each URL).

You can extend this pattern to looking at SQL logs, authentication logs, etc... You can make a longer time window to develop baselines for, keep track on a daily/weekly/monthly basis, make the limits more than 2 standard deviations above the normal, require more than 10, aggregate based on source/client, etc... You will need to play around with these values to determine values that aren't too noisy, yet detect what you are looking for.