Cloudflare extends autonomous DDoS detection to the edge
Cloudflare has expanded its autonomous DDoS protection system so that detection and mitigation can happen directly at the network edge, across every server in all 200+ data centers. The system protects customers against attacks at layers 3 through 7 of the OSI model without human intervention and without additional cost to the customer, per Cloudflare's unmetered DDoS mitigation commitment.
The software-defined system runs on commodity servers and is powered by the denial of service daemon (dosd), which originally launched in mid-2019 to handle L3/4 attacks. The latest iteration extends dosd to cover L7 attacks as well. Every server continuously analyzes packets and HTTP requests, and when an attack is detected, the system immediately generates a signature and pushes a mitigation rule to the most effective point in the Linux stack for cost-efficient blocking.
Complementing core detection with edge sampling
Cloudflare's existing threat detection system, Gatebot, operates from the network core and is well-suited for large, distributed volumetric attacks that require coordination across the entire edge. But smaller, localized attacks demand a different approach. By detecting network-layer and HTTP attacks at the edge, the system can sample at a much higher rate — 10 times greater for HTTP requests and 81 times faster for packets than core sampling — and generate mitigation rules immediately. Over recent months, dosd has detected 98.6% of all L3/4 attacks and, since its expansion, 81% of all L7 attacks.
Packet flow and mitigation paths
When a packet arrives at a Cloudflare data center via BGP Anycast and ECMP routing, it enters a group of XDP programs called L4Drop. L4Drop applies mitigation rules from previously detected attacks and forwards packet samples to dosd for analysis. If the packet is not dropped, it moves to Unimog, Cloudflare's proprietary L4 load balancer, which decides whether to keep the packet on the current server or route it to another based on health and performance metrics.
From there, the packet goes through the iptables firewall and, if it targets an L7 application, to the HTTP reverse proxy in userspace where it passes through the Web Application Firewall and customer configurations. Packets destined for TCP/UDP services via Spectrum or IP routing via Magic Transit bypass the HTTP proxy and go through those systems instead.
dosd, Gatebot, and flowtrackd analyze the samples they receive and push mitigation rules into the web proxy, where attack requests are handled with a block, rate limit, or challenge action. For highly volumetric attacks, the mitigation rule is pushed further down the stack into the iptables firewall, where L7 attacks are dropped at L4 using IP Jails for more cost-efficient mitigation. L3/4 attacks are handled with eBPF programs inside L4Drop. This layered approach allows Cloudflare to automatically mitigate DDoS attacks at scale.
Why edge detection matters
The expanded autonomous system is a response to the growing ease and affordability of launching DDoS attacks. Attackers can utilize free public tools or hire DDoS-as-a-service botnets for as little as $10 for a one-hour attack at 10-50k requests per second, according to the Dark Web Price Index for 2020. Meanwhile, the damage from an outage or even just latency can be significant — a minute of downtime for an ecommerce site can result in the loss of tens of thousands of dollars.
Cloudflare's DDoS trends reports have documented an increase in both the frequency and size of attacks, as well as growing sophistication such as the attack that imitated acoustic beats. The system aims to block both large and small attacks, as even modest attacks can take down smaller web properties.
