Distributed denial of service solution using a dpu

A computing system comprising:

• a data processing unit (DPU) comprising a network interface, a host interface, a central processing unit (CPU), and an acceleration hardware engine, the DPU to host a hardware-accelerated security service to protect a host device from a distributed denial of service (DDoS) attack, wherein the hardware-accelerated security service is to extract a plurality of features from network traffic data received on the network interface, generate a feature vector based on the plurality of features, and provide the feature vector as input to a machine learning (ML) detection system trained to distinguish DDoS traffic from normal traffic;
• and
• a resource controller coupled to the DPU, wherein the resource controller is a provisioning server that provisions resources of the host device, wherein:
• the DPU is configured to determine, using the ML detection system, whether the host device is subject to a DDoS attack based on the feature vector and send an alert to the resource controller responsive to a determination that the host device is subject to the DDoS attack;
• and
• the resource controller is configured to perform one or more operations to prevent the DDoS attack from having an effect on the resources of the host device in response to receiving the alert.

A method comprising:

• extracting, by a data processing unit (DPU), a plurality of features from network traffic data directed to a host device;
• generating, by the DPU, a feature vector based on the plurality of features;
• determining, by the DPU using a machine learning (ML) detection system trained to distinguish distributed denial of service (DDoS) traffic from normal traffic, that the host device is subject to a DDoS attack based on the feature vector;
• sending, by the DPU, an alert to a resource controller responsive to the determination, wherein the resource controller is a provisioning server that provisions resources of the host device;
• and
• performing, by the resource controller, one or more operations to prevent the DDoS attack from having an effect on the resources of the host device in response to receiving the alert.