Detection: Ollama Possible Memory Exhaustion Resource Abuse

Description

Identifies high Ollama runner counts and large model buffer allocations as possible resource pressure indicators. Memory values vary with model size and hardware, and these operational logs do not establish malicious intent; validate against host capacity and workload baselines.

Search

 1`ollama_server`
 2("*llama_kv_cache*" OR "*compute buffer*" OR "*llama runner started*" OR "*loaded runners*")
 3
 4
 5| rex field=_raw "count=(?<runner_count>\d+)"
 6
 7| rex field=_raw "(?<memory_mb>[\d\.]+)\s+MiB"
 8
 9| rex field=_raw "started in\s*(?<load_time>[\d\.]+)\s*seconds"
10
11| rex field=_raw "source=(?<code_source>[^\s]+)"
12
13
14| bin _time span=5m
15
16
17| stats count as operations
18        avg(load_time) as avg_load_time
19        avg(memory_mb) as avg_memory
20        dc(code_source) as unique_sources
21        max(load_time) as max_load_time
22        max(memory_mb) as max_memory
23        max(runner_count) as peak_loaded_runners
24        values(code_source) as code_sources
25  by _time host
26
27
28| where operations > 10 OR peak_loaded_runners > 5 OR max_memory > 400
29
30
31| eval avg_memory=round(avg_memory, 2)
32
33| eval max_memory=round(max_memory, 2)
34
35| eval avg_load_time=round(avg_load_time, 2)
36
37| eval max_load_time=round(max_load_time, 2)
38
39| eval severity=case(peak_loaded_runners > 10, "critical", peak_loaded_runners > 5 OR operations > 20, "high", max_memory > 400 OR operations > 10, "medium", 1=1, "low")
40
41| eval attack_type="Resource Pressure / Memory Allocation"
42
43
44| table _time host operations peak_loaded_runners
45        unique_sources avg_memory max_memory
46        avg_load_time max_load_time severity attack_type
47
48
49| `ollama_possible_memory_exhaustion_resource_abuse_filter`

Data Source

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.

Known False Positives

Legitimate high-volume production workloads processing multiple concurrent requests, users loading large language models (7B+ parameters) that naturally require substantial memory allocation, simultaneous multi-model deployments during system scaling, batch processing operations, or initial system startup sequences may generate similar memory allocation patterns during normal operations.

Associated Analytic Story

• Suspicious Ollama Activities

Intermediate Findings

References

• https://github.com/rosplk/ta-ollama

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 5