Skip to content

Latest commit

 

History

History
26 lines (21 loc) · 2.02 KB

Lacking-RateLimiting.md

File metadata and controls

26 lines (21 loc) · 2.02 KB

Absence of Rate Limiting in ML/AI Interfaces

Description

Machine Learning and Artificial Intelligence interfaces, when exposed without rate-limiting measures, are prone to overuse and abuse. The lack of rate limiting can lead to resource exhaustion and service disruption due to Denial-of-Service attacks, which may be caused by malicious bots, automated scripts, or system misconfigurations.

Extended Description

Rate limiting is crucial to prevent a system from being overwhelmed by too many requests. It is a critical security and operational measure that ensures the ML/AI systems' computational resources are not exhausted, by controlling the number of requests from an entity within a specified time frame.

Potential Mitigations

  • Rate Limiting Protocols: Employ algorithms like token bucket or leaky bucket to manage request volume.
  • IP-based Limiting: Restrict requests based on the requester's IP address.
  • User Authentication and Tiered Access: Authenticate users and assign request limits based on user levels.
  • Monitoring and Alerts: Set up continuous monitoring and alerts for abnormal traffic patterns.
  • Captcha or Challenge-Response: Use Captchas or challenges for web-facing interfaces to block automated bots.
  • Geo-based Rate Limiting: Apply different request limits for regions with known malicious activities.

Related Weaknesses

  • CWE-770: Pertains to the allocation of resources without limits or throttling.
  • CWE-400: Addresses the risk of uncontrolled resource consumption.

Impact Analysis

  • Resource Depletion: Excessive traffic can cause slowdowns or outages.
  • Denial-of-Service Attacks: Attackers could disrupt the service for legitimate users.
  • Increased Operational Costs: High traffic can lead to higher costs, especially in cloud-based environments.
  • Degraded User Experience: Service quality for regular users may decrease due to high load.
  • Potential for Exploits: High volumes of traffic can reduce the scrutiny of inputs, leading to possible exploits.