Tracing mechanism for monitoring and analysis of cloud-based communication session attacks

A computer program product, comprising a non-transitory machine-readable storage medium having encoded therein executable code of one or more software programs, wherein the one or more software programs when executed by at least one processing device perform the following steps:

• detecting a potential attack associated with a session from a potential attacker based on one or more predefined anomaly detection criteria;
• adding a tracing flag identifier to at least one response packet;
• sending a notification to at least one cloud provider of the potential attack, wherein the notification comprises the tracing flag identifier;
• and
• sending the at least one response packet to the potential attacker,
• wherein, in response to receiving the at least one response packet with said tracing flag identifier, the at least one cloud provider performs the following steps:
• determine a source of the potential attack based on a destination of the at least one response packet;
• forward the at least one response packet to the potential attacker based on the destination of the at least one response packet;
• and
• monitor the determined source to evaluate the potential attack.

An apparatus, comprising:

• a memory;
• and
• at least one processing device, coupled to the memory, operative to implement the following steps:
• detecting a potential attack associated with a session from a potential attacker based on one or more predefined anomaly detection criteria;
• adding a tracing flag identifier to at least one response packet;
• sending a notification to at least one cloud provider of the potential attack, wherein the notification comprises the tracing flag identifier;
• and
• sending the at least one response packet to the potential attacker,
• wherein, in response to receiving the at least one response packet with said tracing flag identifier, the at least one cloud provider performs the following steps:
• determine a source of the potential attack based on a destination of the at least one response packet;
• forward the at least one response packet to the potential attacker based on the destination of the at least one response packet;
• and
• monitor the determined source to evaluate the potential attack.