DDoS Threat Intelligence

DDoS attacks fall into three main categories, often combined for maximum impact.

Volumetric Attacks

What They Are: Massive floods of traffic designed to saturate your internet bandwidth.

How They Work:

• Send enormous amounts of data to your network
• Consume all available bandwidth
• Legitimate traffic can't get through

Common Examples:

• UDP floods
• ICMP floods
• DNS amplification
• NTP amplification

Impact:

• Network completely saturated
• All services become unreachable
• Can reach 1+ Tbps in size

Defense Strategy:

• Requires massive scrubbing capacity
• Cloud-based mitigation essential for large attacks
• Bandwidth at target location is irrelevant—attack must be stopped upstream

Protocol Attacks

What They Are: Attacks that exploit weaknesses in network protocols to exhaust server or network equipment resources.

How They Work:

• Target connection state tables in servers, firewalls, load balancers
• Send malformed packets that consume processing power
• Exploit protocol handshake processes

Common Examples:

• SYN floods (half-open connections)
• ACK floods
• Fragmented packet attacks
• TCP state exhaustion

Impact:

• Servers run out of connection slots
• Firewalls and load balancers crash
• Network equipment becomes unresponsive

Defense Strategy:

• Requires stateful inspection and filtering
• Connection rate limiting
• SYN cookies and proxy mechanisms
• Protocol anomaly detection

Application Layer Attacks (Layer 7)

What They Are: Sophisticated attacks targeting web applications, APIs, and specific services.

How They Work:

• Mimic legitimate user behavior
• Target resource-intensive functions (database queries, file uploads, search)
• Harder to distinguish from real traffic

Common Examples:

• HTTP/HTTPS floods
• Slowloris (slow connections)
• WordPress XML-RPC attacks
• API abuse

Impact:

• Web servers become overloaded
• Database connections exhausted
• Application crashes without obvious network flooding

Defense Strategy:

• Requires application-aware filtering
• Rate limiting per user/IP
• CAPTCHA challenges
• Behavior analysis and anomaly detection

Multi-Vector Attacks

The Growing Threat: Modern attackers combine multiple attack types simultaneously.

Why It's Effective:

• Overwhelms multiple defensive layers at once
• Forces you to respond to several threats simultaneously
• Increases chance of finding a weakness

Example Scenario:

• Start with volumetric UDP flood (saturates bandwidth)
• Add SYN flood (exhausts firewall)
• Follow with HTTP flood (overwhelms web servers)
• All happening at the same time

Defense Requirement: Comprehensive multi-layered protection that handles all attack types simultaneously.

‍