Systems and methods for discovery and classification of denial of service attacks in a
distributed computing system may employ local agents on nodes thereof to detect resource-related events. An information later agent may determine if events indicate attacks, perform clustering analysis to determine if they represent known or unknown
attack patterns, classify the attacks, and initiate appropriate responses to prevent and / or mitigate the
attack, including sending warnings and / or modifying
resource pool(s). The
information layer agent may consult a
knowledge base comprising information associated with known
attack patterns, including state-action mappings. An
attack tree model and an
overlay network (over which detection and / or response messages may be sent) may be constructed for the distributed
system. They may be dynamically modified in response to changes in
system configuration, state, and / or
workload.
Reinforcement learning may be applied to the tuning of attack detection and classification techniques and to the identification of appropriate responses.