System and methods of defense against DDoS attacks for applications on a multi-substrate multi-ingress shared infrastructure

A method implemented at an orchestration engine in a computing services environment providing computing services to a plurality of recipients via the Internet, the method comprising:

• identifying a plurality of application-layer request messages received at the computing services environment, each of the plurality of application-layer request messages being received from a respective source of a plurality of sources via a respective ingress path of a plurality of network ingress paths and being directed to a respective domain of a plurality of domains accessible via the computing services environment;
• determining a probability that a spike in domain-specific network traffic corresponds to an application-layer distributed denial of service attack for a designated domain;
• upon determining that the probability surpasses a designated threshold:
• classifying individual sources among the plurality of sources based on application-layer characteristics of a subset of the plurality of application-layer request messages directed to the designated domain, the individual sources including a first source classified as associated with malicious behavior and a second source classified as potentially associated with the application-layer distributed denial of service attack,
• determining via a processor a plurality of domain-specific mitigation policies indicating for each of a plurality of source-domain-ingress path combinations whether to restrict subsequent communication from a respective source to the designated domain through a respective network ingress path,
• generating, from the classifications of the individual sources and the determinations for the plurality of source-domain-ingress path combinations, the plurality of domain-specific application-layer mitigation policies including:
• (i) a blocked-source list identifying the first source and corresponding to a first rule configured to block subsequent application-layer request messages from the first source from reaching the designated domain via a first network ingress path, and (ii) an updated rate-limiting plan identifying the second source and corresponding to a second rule configured to throttle subsequent application-layer request messages from the second source to the designated domain via a second network ingress path, and
• generating a report characterizing the application-layer distributed denial of service attack and the plurality of domain-specific application-layer mitigation policies via a generative language model interface, wherein the orchestration engine is further configured to identify a recipient of the plurality of recipients that is likely affected by the application-layer distributed denial of service attack and to transmit the report to the recipient;
• and
• transmitting one or more instructions to implement the plurality of domain-specific application-layer mitigation policies to one or more controllers via a communication interface.

One or more non-transitory computer readable media having instructions stored thereon for performing a method implemented at an orchestration engine in a computing services environment providing computing services to a plurality of recipients via the Internet, the method comprising:

• identifying a plurality of application-layer request messages received at the computing services environment, each of the plurality of application-layer request messages being received from a respective source of a plurality of sources via a respective ingress path of a plurality of network ingress paths and being directed to a respective domain of a plurality of domains accessible via the computing services environment;
• determining a probability that a spike in domain-specific network traffic corresponds to an application-layer distributed denial of service attack for a designated domain;
• upon determining that the probability surpasses a designated threshold:
• classifying individual sources among the plurality of sources based on application-layer characteristics of a subset of the plurality of application-layer request messages directed to the designated domain, the individual sources including a first source classified as associated with malicious behavior and a second source classified as potentially associated with the application-layer distributed denial of service attack,
• determining via a processor a plurality of domain-specific mitigation policies indicating for each of a plurality of source-domain-ingress path combinations whether to restrict subsequent communication from a respective source to the designated domain through a respective network ingress path,
• generating, from the classifications of the individual sources and the determinations for the plurality of source-domain-ingress path combinations, the plurality of domain-specific application-layer mitigation policies including:
• (i) a blocked-source list identifying the first source and corresponding to a first rule configured to block subsequent application-layer request messages from the first source from reaching the designated domain via a first network ingress path, and (ii) an updated rate-limiting plan identifying the second source and corresponding to a second rule configured to throttle subsequent application-layer request messages from the second source to the designated domain via a second network ingress path, and
• generating a report characterizing the application-layer distributed denial of service attack and the plurality of domain-specific application-layer mitigation policies via a generative language model interface, wherein the orchestration engine is further configured to identify a recipient of the plurality of recipients that is likely affected by the application-layer distributed denial of service attack and to transmit the report to the recipient;
• and
• transmitting one or more instructions to implement the plurality of domain-specific application-layer mitigation policies to one or more controllers via a communication interface.