Must Learn AI Security Part 11: Denial-of-Service Attacks Against AI

Chapter 11

Sep 11, 2023

This post is part of an ongoing series to educate about new and known security vulnerabilities against AI.

The full series index (including code, queries, and detections) is located here:

The book version (pdf) of this series is located here: https://github.com/rod-trent/OpenAISecurity/tree/main/Must_Learn/Book_Version

The book will be updated when each new part in this series is released.

What is a Denial-of-Service attack against AI?

A Denial-of-Service (DoS) attack against AI refers to an attempt by an attacker to disrupt the normal functioning of an AI system, rendering it unavailable or unusable for its intended users. The primary goal of a DoS attack is to overwhelm the targeted AI system or its underlying infrastructure with a large volume of requests, computations, or data, causing the system to slow down, crash, or become unresponsive.

Types of Denial-of-service attacks

A Denial-of-Service (DoS) attack against AI works by targeting the AI system or its underlying infrastructure to overwhelm its resources, causing it to become slow, unresponsive, or unavailable for its intended users. Here are some common techniques used in DoS attacks against AI:

Request flooding: The attacker sends an excessive number of requests or inputs to the AI system, consuming its processing power, bandwidth, or memory. As a result, the system becomes overwhelmed and unable to serve legitimate users.
Adversarial examples: The attacker crafts malicious inputs, known as adversarial examples, designed to confuse or mislead the AI model. These inputs can cause the model to perform computationally expensive tasks, leading to slowdowns or system crashes.
Amplification attacks: The attacker exploits vulnerabilities in the AI model or its algorithms to generate an outsized response from the system, consuming more resources than a regular input would. This amplification effect can quickly exhaust the system's resources.
Targeting infrastructure: The attacker targets the underlying infrastructure that supports the AI system, such as servers, cloud services, or network components. By overwhelming these resources, the attacker can indirectly disrupt the AI system's functioning.
Exploiting software or hardware vulnerabilities: The attacker may exploit known vulnerabilities in the AI system's software or hardware to cause crashes, memory leaks, or resource exhaustion.
Model poisoning: The attacker injects malicious data into the AI system's training dataset, causing the model to learn incorrect or harmful behavior. This can lead to system performance issues or intentional misclassifications that result in service disruption.

By employing one or more of these techniques, an attacker can cause a Denial-of-Service attack against an AI system, disrupting its functionality and preventing legitimate users from accessing its services. It is essential for organizations to implement robust security measures and monitoring capabilities to detect and mitigate the risk of DoS attacks against their AI systems.

Why it matters

A Denial-of-Service (DoS) attack against AI can have several negative effects on the targeted AI system, its users, and the organization responsible for the system. Some of these negative effects include:

System unavailability: The primary effect of a DoS attack is making the AI system slow, unresponsive, or completely unavailable, preventing users from accessing its services and causing disruptions in its normal functioning.
Loss of productivity: As the AI system becomes unavailable or unresponsive, users who depend on its services may experience a decline in productivity, leading to delays, missed opportunities, or additional costs to the organization.
Financial loss: The direct and indirect costs associated with mitigating a DoS attack, such as increased bandwidth usage, system repairs, and service restoration, can result in significant financial losses for the affected organization.
Reputation damage: A successful DoS attack against an AI system can damage the reputation of the organization responsible for the system, causing users to lose trust in its reliability and security.
Loss of competitive advantage: In cases where the AI system provides a competitive advantage to the organization, a DoS attack can lead to a temporary or even permanent loss of that advantage, especially if users switch to alternative services or providers.
Data loss or corruption: In some cases, a DoS attack can lead to data loss or corruption, particularly if the attack exploits vulnerabilities in the AI system's software or hardware.
Increased security costs: Organizations targeted by DoS attacks often need to invest in additional security measures, such as improved monitoring, intrusion detection, and mitigation strategies, to prevent future attacks. These investments can increase the overall cost of maintaining and operating the AI system.

Why it might happen

An attacker may have different motivations for launching a Denial-of-Service (DoS) attack against AI systems. Some potential gains for the attacker include:

Disruption: By causing an AI system to become slow, unresponsive, or unavailable, the attacker can create significant disruptions in its normal functioning, leading to loss of productivity and inconvenience for users who depend on the AI system.
Financial gain: In some cases, attackers may demand a ransom in exchange for stopping the attack, or they may launch a DoS attack as a distraction while attempting to commit other types of cybercrimes, such as data theft or unauthorized access.
Competition: An attacker may be motivated by a desire to harm the targeted organization's reputation or competitive advantage, particularly if the AI system is a key component of the organization's business strategy or operations.
Political or ideological motivations: Some attackers may target AI systems due to political or ideological reasons, intending to disrupt operations or cause harm to the organization responsible for the system.
Demonstrating technical prowess: In some cases, attackers may want to show off their technical skills by successfully attacking a high-profile AI system, potentially seeking recognition or validation within the hacker community.
Testing and reconnaissance: An attacker might launch a DoS attack against an AI system to test its security measures or gather information about the system's vulnerabilities, which can be exploited in future attacks.

While an attacker may not gain direct access to sensitive data or system resources through a DoS attack, the negative impact on the targeted AI system and the organization responsible for it can be significant. Therefore, it is essential for organizations to implement robust security measures, monitor their AI systems for signs of potential threats, and develop a comprehensive incident response plan to quickly detect, mitigate, and recover from DoS attacks.

Real-world Example

While there are no widely publicized examples of a Denial-of-Service (DoS) attack specifically targeting an AI system, there have been instances of DoS attacks against web services and platforms that employ AI technology. One example is the attack on Dyn, a major DNS provider, in 2016.

In October 2016, a massive Distributed Denial-of-Service (DDoS) attack targeted Dyn, which provided DNS services to numerous high-profile websites. The attack involved a botnet of Internet of Things (IoT) devices, such as cameras, routers, and other connected devices, which were infected with the Mirai malware. This botnet flooded Dyn's servers with an overwhelming volume of traffic, causing disruptions and outages for many popular websites, including Twitter, Reddit, Spotify, and others.

While this attack was not aimed directly at an AI system, it serves as an example of how a DoS attack can disrupt services that rely on AI technology. Many of the affected websites and platforms use AI for various purposes, such as content recommendation, personalization, and targeted advertising. The attack on Dyn disrupted these AI-driven services, along with other non-AI services, by making them temporarily unavailable.

How to Mitigate

Mitigating a Denial-of-Service (DoS) attack against AI involves implementing various security measures and strategies to protect the AI system and its underlying infrastructure. Some steps to mitigate DoS attacks against AI include:

Redundancy and load balancing: Deploying multiple instances of the AI system across different servers or cloud resources can help distribute the load during an attack, reducing the impact of a DoS attack. Load balancing techniques can further ensure that traffic is evenly distributed among available resources.
Rate limiting: Implementing rate limiting can help control the number of requests or inputs an AI system processes within a specific time frame, preventing it from being overwhelmed by a sudden surge in requests.
Traffic filtering and monitoring: Deploying tools such as intrusion detection systems (IDS) and firewalls to monitor and filter traffic can help identify and block malicious requests or inputs before they reach the AI system.
Secure software development: Ensuring that the AI system and its underlying software are developed using secure coding practices can minimize vulnerabilities that attackers may exploit during a DoS attack.
Regular updates and patching: Keeping the AI system and its underlying infrastructure up to date with the latest security patches can help prevent known vulnerabilities from being exploited during an attack.
DDoS protection services: Employing DDoS protection services offered by specialized security providers can help detect and mitigate large-scale distributed attacks that target the AI system or its supporting infrastructure.
Data and model integrity: Monitoring and validating the AI system's training data and model can help detect and mitigate model poisoning attacks, ensuring the system's accuracy and performance are not compromised.
Incident response planning: Developing and maintaining a comprehensive incident response plan can help organizations quickly detect, contain, and recover from a DoS attack, minimizing its impact on the AI system and its users.
Employee training and awareness: Regularly training employees on security best practices and raising awareness about the potential risks of DoS attacks can help create a culture of security within the organization.

By implementing these mitigation strategies, organizations can significantly reduce the risk of DoS attacks against their AI systems, ensuring their continued availability and performance for legitimate users.

How to monitor/What to capture

To detect a Denial-of-Service (DoS) attack against AI, organizations should monitor various aspects of their AI system, its underlying infrastructure, and the network traffic. Some key components to monitor include:

Traffic volume: Keep an eye on sudden spikes in the volume of incoming requests or inputs, as they could indicate a potential DoS attack. Monitoring tools can help set thresholds for normal traffic levels and alert when these thresholds are exceeded.
Traffic patterns: Unusual patterns in traffic, such as an increase in requests from a specific geographical location, IP address, or a group of IP addresses, could be indicative of an attack. Analyzing these patterns can help identify and block malicious traffic.
Latency and response times: Monitoring the AI system's latency and response times can help detect performance issues that may be caused by a DoS attack. If response times are unusually high or the system becomes unresponsive, it could be a sign of an ongoing attack.
System resource usage: Keep track of the AI system's CPU, memory, and bandwidth usage. Abnormal usage levels could indicate that the system is under attack or experiencing performance issues.
Error rates and logs: Monitor the AI system's error rates and logs for any unusual activity or patterns that could suggest a DoS attack, such as an increase in failed requests or a high number of error messages.
System and application performance: Track the performance of the AI system and its underlying applications, as performance degradation could be a sign of a DoS attack or other issues affecting the system.
Infrastructure health: Monitor the health and performance of the underlying infrastructure supporting the AI system, including servers, network devices, and cloud resources. Unusual behavior or failures in these components could indicate an attack targeting the infrastructure.
Data integrity: Keep an eye on the AI system's training data and model to detect any signs of data tampering or model poisoning, which could be part of a DoS attack aimed at disrupting the system's performance.
Security alerts and logs: Use intrusion detection systems (IDS), firewalls, and other security tools to monitor and analyze security alerts and logs, helping to identify potential DoS attacks or other security threats.

By actively monitoring these components, organizations can quickly identify potential DoS attacks against their AI systems and take appropriate action to mitigate the impact of such attacks.

[Want to discuss this further? Hit me up on Twitter or LinkedIn]
[Subscribe to the RSS feed for this blog]
[Subscribe to the Weekly Microsoft Sentinel Newsletter]
[Subscribe to the Weekly Microsoft Defender Newsletter]
[Subscribe to the Weekly Azure OpenAI Newsletter]
[Learn KQL with the Must Learn KQL series and book]
[Learn AI Security with the Must Learn AI Security series and book]