Alerting

How to detect and alert abnormal spikes of web api requests

bestSplunker
Contributor

hi. everyone .

My website has some API interfaces. Sometimes malicious attacks will request these api continuously. It is clear on the time chart that the peak has been reached. How do I detect and alert?

for example:

I have a search like this now, I can see the number of requests per hour for these URIs.

index = web   sourcetype=nginx_access   uri=/api/getuserInfo   OR uri=/api/featchData OR uri=/login  OR uri=/home
|timechart span=1h count by uri

under normal conditions the request per hour of /api/getuserInfo is about 1000~5000 times, if a certain time period encounters a malicious attack, the interface requests 50,000 times. I think this is an anomaly. How should I use a smarter method to detect abnormal peaks and issue alarms?

I think of a stupid way, i can write the number of api interface requests per hour to csv or kvstore, and then use today's and yesterday's comparisons to see the magnitude of the rise. If the rise is too high, I think this is abnormal peaks

But I think there are more efficient methods, such as machine learning? Can someone help me and share a use case with me, thank you

Note: I have a lot of API interfaces, about 20, I want to monitor the abnormal peak of each API interface,

0 Karma
1 Solution

niketn
Legend

@bestSplunker you can refer to Detect Numerical Outlier examples in Splunk Machine Learning Toolkit to check out methods to find outliers and choose the best one as per your data needs. Refer to recent answer: https://answers.splunk.com/answers/754085/calculating-median-of-count-over-time.html

Even if you do not install MLTK in your production system you can use the SPL directly (generated by MLTK in non-prod system) along with Splunk's built in visualization to depict the outliers. Refer to an older answer of mine: https://answers.splunk.com/answers/747177/how-to-add-a-reference-line-to-an-outlier-chart-cr.html

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@bestSplunker you can refer to Detect Numerical Outlier examples in Splunk Machine Learning Toolkit to check out methods to find outliers and choose the best one as per your data needs. Refer to recent answer: https://answers.splunk.com/answers/754085/calculating-median-of-count-over-time.html

Even if you do not install MLTK in your production system you can use the SPL directly (generated by MLTK in non-prod system) along with Splunk's built in visualization to depict the outliers. Refer to an older answer of mine: https://answers.splunk.com/answers/747177/how-to-add-a-reference-line-to-an-outlier-chart-cr.html

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

woodcock
Esteemed Legend
0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...