Splunk Enterprise Security

SPL to check for timing attacks

jogonz20
Explorer

Hello fellow splunkers,

I would like to know if someone has come across a way to determine via a splunk query timing attacks, I have read some posts on github pointing out to useful information but still nothing concrete.

I know we could do something with machine learning but not sure how to deal with it deeply in order to check for so.

Thanks so much,

0 Karma

sduff_splunk
Splunk Employee
Splunk Employee

You may find that ML is overkill for this particular use-case.

Consider Apache web logs, for example, which can be configured to include the RequestTimeSeconds, which is the time taken to process a request.

You could then create an alert with something like the following:

index=weblogs earliest=-30m@m | eventstats count, avg(RequestTimeSeconds) as avg_rts, stdev(RequestTimeSeconds) as stdev_rts by url | where RequestTimeSeconds>(2*stdev_avg+avg_rts) AND count>10

This will give you a list of URLs that have been accessed more than 10 times, and have occurrences where the time to respond has been over 2 standard deviations above the average (per each URL).

You can extend this pattern to looking at SQL logs, authentication logs, etc... You can make a longer time window to develop baselines for, keep track on a daily/weekly/monthly basis, make the limits more than 2 standard deviations above the normal, require more than 10, aggregate based on source/client, etc... You will need to play around with these values to determine values that aren't too noisy, yet detect what you are looking for.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please explain your use case.  What is a "timing attack"?  How would you detect one?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...