Mitigating Unusual Listener Behavior

News

This week, we’ve been working on a replacement system for mitigating certain types of unusual listener behavior. For more details, read on.

As the station has continued to grow over time, one of the exercises we’ve had to run through is what to do in case of unusual connection activity as it pertains to the radio station. In the past, we’ve limited concurrent connections and had an “auto-ban” system which would outright prevent connections from clients that exceeded certain defined thresholds. However, even with very high tolerances for unusual activity, the system would still occasionally catch legitimate listeners who, for example, simply left their web browsers open at their office computer over the weekend. These false positives would need manual intervention to undo them and create additional management overhead. That system was removed earlier this year.

During Live #152 this past weekend, we observed a DoS (denial of service) attack which caused instability for legitimate listeners. Attacks like these highlight the need for automated handling of bad actors, so we’re revisiting this function of the station. A few early goals we have in mind for the new system are to:

• Issue multiple temporary bans ahead of permanent ones
• Keep the system lean and fast for responsive connections
• Provide feedback in case legitimate users are caught
• Provide recommendations on potential causes and things to avoid

The idea is to keep the station running well for real listeners while discouraging or disabling behaviors which may negatively impact station performance. As a reminder, listeners should generally only use one connection to listen, and remember to stop or close players when they’re not in use. Any exceptions will still need to be manually reviewed.

That’s all for this week! We’re always cooking up something behind the scenes, so stay tuned for more, and thanks for listening!

[Knowledge #201]

Suggested Posts