Automatic Anomaly Detection in IRP
Noction IRP v4.3 added Automatic Anomaly Detection (AAD), a behavior-based traffic analysis engine built into the Intelligent Routing Platform. Instead of fixed thresholds, AAD watches traffic telemetry from NetFlow, sFlow, or mirrored traffic and builds its own baseline for what “normal” looks like on a given network. When traffic breaks from that baseline for a sustained stretch (a packet-rate spike, one protocol suddenly dominating, an inbound surge with nothing matching it outbound), AAD flags it and can trigger mitigation through IRP’s existing BGP controls: Remote Triggered Blackholing and BGP FlowSpec.
At launch, AAD already covered DNS and NTP amplification, UDP floods, TCP SYN/ACK floods, HTTP(S) floods, SSH floods, and ICMP/Smurf-style attacks.
Additional vectors covered
Reflection and amplification attacks stay popular because they’re cheap to run. An attacker spoofs a victim’s IP address, sends a small query to an open, publicly reachable service, and lets that service handle the work of sending back a much larger response. CISA’s advisory on UDP-based amplification attacks lists a long list of exploitable protocols beyond DNS and NTP, and vendor telemetry from Netscout and Akamai continues to show these vectors being abused, largely because so many misconfigured, internet-facing devices remain exposed.
In IRP v 4.3.1, we’ve added five more reflection/amplification vectors to AAD:
SSDP / UPnP amplification. UPnP devices: routers, printers, smart-home gear, use SSDP to advertise themselves on a local network. When one ends up exposed to the public internet, a small M-SEARCH query can come back as a much bigger reply. Reported amplification factors for SSDP usually land around 30x.
Memcached amplification. Memcached is an in-memory key-value store used to speed up web apps. If its UDP interface (port 11211) is open to the internet with no authentication, a tiny request can turn into a massive response. Memcached has the highest known amplification factor of any reflection vector, with some reports putting it in the tens of thousands, and it’s what powered the 1.3 Tbps attack against GitHub in 2018.
CLDAP amplification. Connection-less LDAP, used by directory services like Active Directory, can be abused so that a small query returns a much larger directory response. Akamai puts the amplification factor at roughly 56–70x.
Chargen amplification. Character Generator is an old testing/debugging protocol that streams character data back to anyone who asks. The protocol itself is largely obsolete, but wherever it’s still exposed, the size gap between request and response makes it a workable amplifier.
SNMP amplification. SNMPv2 is used to monitor and manage network devices, and it can be abused through spoofed GetBulk requests to return responses larger than the query. The amplification factor here is modest next to Memcached or Chargen, but SNMP sits on so much managed network gear that it’s an easy target regardless.
How the Noction IRP’s Automatic Anomaly Detection spots them
These five vectors run through the same behavior-based detection AAD already uses elsewhere, not a separate rule bolted on per protocol. For reflection and amplification traffic, AAD looks at:
- Protocol and port concentration: a sustained jump in traffic from known reflector ports (UDP/1900 for SSDP, UDP/11211 for Memcached, UDP/389 for CLDAP, UDP/19 for Chargen, UDP/161 for SNMP).
- Traffic asymmetry: a wave of large inbound responses with no matching outbound queries from the protected network, which is basically the signature of a spoofed-source reflection attack.
- Deviation from baseline: comparing the current protocol mix and packet rates against what IRP has already learned is normal for that network, so a legitimate SNMP polling spike doesn’t get flagged as an attack by mistake.
Detection sensitivity and stabilization settings are configurable, so a short blip doesn’t set off a response. Only sustained patterns that actually resemble an attack do.
From detection to mitigation
Once IRP confirms one of these attacks, it responds with the same routing-native tools used across the rest of AAD: BGP FlowSpec for protocol/port-specific filtering that drops the bad traffic while leaving legitimate flows alone, and Remote Triggered Blackholing for cases where dropping everything to a target destination is the right call. Operators can run this fully automated, or in moderated mode, where IRP suggests a mitigation action in the Global Management Interface and waits for a person to confirm it.
Reflection traffic arrives from a large, distributed set of source IPs that each look legitimate on their own (they’re just reflectors doing what they were asked), so FlowSpec’s ability to match on source port, protocol, and packet length matters here. It lets IRP block the abused protocol/port pair without a blanket block on the destination that would also catch unrelated traffic.
These attacks are attractive to run because they need almost no infrastructure: no botnet to maintain, just a list of open reflectors and a spoofed source address. Adding SSDP, Memcached, CLDAP, Chargen, and SNMP to AAD closes gaps against some of the most commonly abused UDP services still sitting on the internet today, without operators having to hand-write a separate detection rule for each one.
Have questions about configuring AAD for your network’s traffic profile? Contact the Noction team or request a demo.
