Tempesta FW `perfstat` analyzing for CDN amplification & bypass attacks detection

[krizhanovsky]

To catch DDoS CDN amplification attacks add Server RX bytes processing of /proc/tempesta/perfstat by a configurable dealy (1 second by default).

• Dynamically, probably with sliding window, compute Client TX bytes as sum(response_content_length) and trigger on spike of Server RX bytes / Client TX bytes ratio.

• Detect the spike on Cache misses / Cache hits to detect cache bypass with no-cache or random URL parameters (test both the cases)

Related Tempesta FW issue tempesta-tech/tempesta#1346 (comment)