Appearance

OOL Shield - Detection Pipelines ​

Detection Pipelines are the core of the OOL Shield. They are where its modularity, depth, and range of features come from, and they let you shape the OOL Shield around your network instead of the other way round. You build your network the way you want; the OOL Shield adapts to it.

How it works ​

A single Detection Pipeline defines one way of handling incoming samples. You can create several pipelines, limited only by the hardware of the node the OOL Shield runs on.

Each pipeline works in three stages: filter, analyze, and act.

1. Filter the samples ​

Samples first pass through one or more filter statements, applied in order and set per pipeline. Only the samples you want this pipeline to look at make it through.

2. Run an algorithm ​

Matching samples are handed to the pipeline's algorithm for processing. Two algorithms are available today, both highly configurable:

  • Volume Attack Detection (VAD) — measures total IP traffic per second from the samples to spot traffic spikes that suggest an attack. It works across multiple prefix lengths, so it also catches attacks spread over many IPs (carpet bombing).
    Use case: blackholing, or re-routing traffic to protection appliances.
  • Generic Anomaly Detection (GAD) — inspects L3 and L4 protocol headers for anomalies on its own, giving accuracy-based detection of generic attacks.
    Use case: mitigating attacks with FlowSpec, or logging and alerting with the details of an attack.

3. Act on the results ​

The algorithm's results go to the Result Handlers you create. Each handler can:

  • filter results — decide whether it should handle a given result, based on attributes like the destination IP (attributes differ per algorithm),
  • run an action on each result it accepts.

The available actions are:

  • Alerting — notify your Alert Contacts by webhook, email, and more.
  • Logging — record results internally for review and debugging, such as trying out new pipeline configurations.
  • API filter enablement — turn on On Premise filtering for the affected destination IPs, for integrated, automatic traffic filtering.
  • Simple BGP IPv4 announcements — announce the destinations from the results to a set of peers, with a chosen community, MED, and other BGP attributes. Mainly used for blackholing.
  • Advanced BGP IPv4 announcements — announce destinations using previously collected BGP route information. Mainly used to dynamically announce DFZ-routable prefixes to protected upstreams during an attack.
  • FlowSpec announcements — announce FlowSpec rules that match anomalous traffic or specific destinations, then DROP, POLICE (rate limit), or REDIRECT. Mainly used to drop attacks at the router level, or redirect them to scrubbing appliances during an attack.

TIP

Need something not listed here? Our team is happy to build a custom solution. We integrate new functions for free, or for a one-time prioritization fee when you need it done on a tight schedule.