ACK Flood is DDoS attack designed to disrupt network activity by saturating bandwidth and resources on stateful devices in its path. By continuously sending ACK packets towards a target, state full defenses can go down (In some cases into a fail open mode) and this flood could be used as a smoke screen for more advanced attacks. This is true for other out of state floods too.

Amplification Attack is any attack where an attacker is able to use an amplification factor to multiply its power. Typical amplification attacks involve DNS, NTP, SSDP and SNMP protocols.

ANAMEANAME stands for address-specific DNS aliases temporarily proposed standard to IETF in the 04 version. More detail is available at https://datatracker.ietf.org/doc/draft-ietf-dnsop-aname/ and https://tools.ietf.org/html/draft-ietf-dnsop-aname-01. Unlike CNAME records, ANAMEs can be placed next to other records (one per hostname). The ANAME belongs to DNS RR type allowing zone owners to redirect queries for apex domain names in a standards compliant manner. So, ANAME and CNAME conflict with each other and cannot co-exist.

Anti-Flood is a set of rules designed to defend against flood attacks. Flood attacks are a form of DoS attack in which the attackers send a large number of requests to a target system to consume enough resources to make the system unable to respond to legitimate requests.

Application Events is a series of malicious HTTP/S requests intended to cause denial of service to the target web domain. It is measured in request per second (rps).

Application layer attack (sometimes referred to as layer 7 DDoS attack) is a form of DDoS attack where attackers target application-layer processes. The attack over-exercises specific functions or features of a website with the intention to disable those functions or features.

Application Programming Interface is a software intermediary allowing two applications to communicate with each other.

Application Protection Service is a service provided to Customer to protect their individual servers from Layer 3 to 7 DDoS attacks plus web application attack, WAF.

AppShield is the Layer 7 application mitigation engine. It is a key component in Application Protection Service.

ASN is the autonomous system number used to identify a routing domain for exchanging exterior routing information with other BGP neighbours.

Attack Event is a series of malicious requests intended to cause denial of service to the target host. The mitigation system classifies attack events into DDoS and WAF events.

Bandwidth Depletion Attacks is an alternative term for Volumetric Attacks.

Baselining is an activity of establishing familiarity to a client's traffic behaviour and pattern resulting in a defined threshold and mitigation technique.

The Border Gateway Protocol (BGP) is a standardized exterior gateway protocol designed to route traffic among autonomous systems (AS) on the Internet. Our OP fully supports BGP routing.

Bit-and-piece attack (a.k.a carpet bombing) is the tactics that attackers use to evade detection of the target. When the attackers craft traffic small enough to bypass detection thresholds which are largely based on the volume of traffic heading for destination IPs, the traffic, once converging, is big enough to cripple the targeted site or even an entire CSP network. Owing to the negligible size of this traffic, typical security devices deployed by ASN-level CSPs are unable to detect and mitigate the traffic before it can cause any harm. The difference between the bit-and-piece pattern and traditional network-layer volumetric attacks is that bit-and-piece exploits the large attack surfaces of ASN-level CSPs, whereas the latter just zero in on one or a few IPs that serve mission-critical services such as websites and mail servers and overwhelm the target by sending voluminous amount of junk.

Blackholing, a.k.a. null route, is a network route that drops all traffic to the victim IP.

Bogon is the address space outside the allowed range for public Internet use. This area of address space includes reserved private address and link-local address ranges such as 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 and 169.254.0.0/16. These reserved networks are also known as Martian packets.

BOT refers to the Internet bot, also known as web robot or web crawler. It is a software application that runs automated tasks which are usually simple and repetitive at a high rate. There are typically two groups of BOT depending on its behaviour. Search engine spiders are generally good bots promoting the presence of the website while the bad bots are used to launch malicious and denial of service attacks.

Botnet is a number of Internet connected compromised devices, each of which is penetrated by malware and running one or more bots. It is very often used by attacker to launch DDoS attack.

Cache is a feature of the Application Protection Service. It is implemented to optimize web user experience.

CAPTCHA Authentication is intended to distinguish whether the request is initiated by a real human or a bot. This method proves to be the most effective way to authenticate legitimate users, but inevitably diverts the user's attention during the time of attack.

Carpet bombing attack see bit-and-piece attack

CLDAP Reflection is a relatively new type of DDoS attack that abuses connectionless Lightweight Directory Access Protocol (LDAP), usually preferred by Windows Exchange. CLDAP uses UDP ports for transport. Traffic is spoofed to the CLDAP protocol server using the IP address to be attacked as the source address.

See Global offload

CNAME stands for Canonical Name record. It is a type of resource record in the Domain Name System.