telemetry (OpenTelemetry, Grafana), anomaly detection, alerts on slow variations, bounded capacity and degradation.
The threat
slow probing, stretched campaigns, progressive service degradation up to partial unavailability, with no spike that trips classic alarms.
Angle mortWhy classic frameworks miss it
alert thresholds are built on spikes; an under-threshold attack stays invisible while fragmenting the signals.
MitigationProposed approach
telemetry (OpenTelemetry, Grafana), anomaly detection, alerts on slow variations, bounded capacity and degradation.
The proposed control
telemetry and degradation bounds on the service.
Expected evidence
a slow attack is detected before operational impact.
SourcesReferences and public research
MITRE ATLAS 2026.07AML.T0029 Denial of AI Service ✓ · AML.T0034 Cost Harvesting ✓
OWASP GenAIOWASP GenAI LLM10:2025 Unbounded Consumption
Recherche publiquePublic research sources: MITRE ATLAS 2026.07 (verified technique mapping), OWASP GenAI (OWASP), and the public risk-voicebot (aivansoul/risk-voicebot) template defining the 20 checkpoints. No client registry data: generic sheet, no rating, no verdict.
couche 19 · Monitoring