Generation of a dataset for DoW attack detection in serverless architectures

José Manuel Ortega Candel; Francisco José Mora Gimeno; Higinio Mora Mora

doi:10.1016/j.dib.2023.109921

Generation of a dataset for DoW attack detection in serverless architectures

Data Brief. 2023 Dec 5:52:109921. doi: 10.1016/j.dib.2023.109921. eCollection 2024 Feb.

Authors

José Manuel Ortega Candel¹, Francisco José Mora Gimeno¹, Higinio Mora Mora¹

Affiliation

¹ Department of Computer Science and Technology, Alicante University, Alicante, Spain.

Abstract

Denial of Wallet (DoW) attacks refers to a type of cyberattack that aims to exploit and exhaust the financial resources of an organization by triggering excessive costs or charges within their cloud or serverless computing environment. These attacks are particularly relevant in the context of serverless architectures due to characteristics like pay-as-you-go model, auto-scaling, limited control and cost amplification. Serverless computing, often referred to as Function-as-a-Service (FaaS), is a cloud computing model that allows developers to build and run applications without the need to manage traditional server infrastructure. Serverless architectures have gained popularity in cloud computing due to their flexibility and ability to scale automatically based on demand. These architectures are based on executing functions without the need to manage the underlying infrastructure. However, the lack of realistic and representative datasets that simulate function invocations in serverless environments has been a challenge for research and development of solutions in this field. The aim is to create a dataset for simulating function invocations in serverless architectures, that is a valuable practice for ensuring the reliability, efficiency, and security of serverless applications. Furthermore, we propose a methodology for the generation of the dataset, which involves the generation of synthetic data from traffic generated on cloud platforms and the identification of the main characteristics of function invocations. These characteristics include SubmitTime, Invocation Delay, Response Delay, Function Duration, Active Functions at Request, Active Functions at Response. By generating this dataset, we expect to facilitate the detection of Denial of Wallet (DoW) attacks using machine learning techniques and neural networks. In this way, this dataset available in Mendeley data repository could provide other researchers and developers with a dataset to test and evaluate machine learning algorithms or use other techniques based on the detection of attacks and anomalies in serverless environments.

Keywords: Botnet; Denial of wallet; Functions as a service; Serverless.