Potential Abuse of Resources by High Token Count and Large Response Sizes

Last updated 19 days ago on 2024-11-05

Created 7 months ago on 2024-05-04

About

Detects potential resource exhaustion or data breach attempts by monitoring for users who consistently generate high input token counts, submit numerous requests, and receive large responses. This behavior could indicate an attempt to overload the system or extract an unusually large amount of data, possibly revealing sensitive information or causing service disruptions.

Tags: Domain: LLMData Source: AWS BedrockData Source: Amazon Web ServicesData Source: AWS S3Use Case: Potential OverloadUse Case: Resource ExhaustionMitre Atlas: LLM04
Severity: medium
Risk Score: 47
False Positive Examples: Authorized heavy usage of the system that is business justified and monitored.
License: Elastic License v2(opens in a new tab or window)

Definition

Integration Pack: Prebuilt Security Detection Rules
Related Integrations: (opens in a new tab or window)
Query

from logs-aws_bedrock.invocation-*
| keep user.id, gen_ai.usage.prompt_tokens, gen_ai.usage.completion_tokens
| stats max_tokens = max(gen_ai.usage.prompt_tokens),
         total_requests = count(*),
         avg_response_size = avg(gen_ai.usage.completion_tokens)
  by user.id
// tokens count depends on specific LLM, as is related to how embeddings are generated.
| where max_tokens > 5000 and total_requests > 10 and avg_response_size > 500
| eval risk_factor = (max_tokens / 1000) * total_requests * (avg_response_size / 500)
| where risk_factor > 10
| sort risk_factor desc

Install detection rules in Elastic Security

Detect Potential Abuse of Resources by High Token Count and Large Response Sizes in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(opens in a new tab or window).