What is a DDoS attack?
A distributed denial-of-service (DDoS) attack is a malicious attempt to obstruct a server, service, or network’s regular traffic by saturating the target or its surrounding infrastructure with an excessive amount of Internet traffic.
By using several hacked computer systems as sources of attack traffic, DDoS assaults are made effective. Computers and other networked resources, like as IoT devices, can be exploited machines.
When viewed from a distance, a DDoS assault resembles an unexpected traffic congestion that blocks the roadway and keeps ordinary traffic from reaching its destination.
How does a DDoS attack work?
DDoS assaults are conducted using networks of computers linked to the Internet.
These networks are made up of computers and other devices, such as Internet of Things (IoT) devices, that have been infected with malware, enabling an attacker to remotely manage them. These particular gadgets are known as bots (or zombies), and a botnet is a collection of bots.
Once a botnet has been created, the attacker may control an attack by giving each bot remote commands.
Each bot in the botnet sends queries to the IP address of the victim’s server or network while that server or network is being targeted by the botnet. This might overload the server or network and result in a denial-of-service attack on regular traffic.
Each bot is an authorized Internet device, therefore distinguishing the attack traffic from normal traffic can be difficult.
How to identify a DDoS attack
An abrupt slowdown or unavailability of a website or service is the most evident sign of a DDoS assault. However, since several factors, including a real increase in traffic, might result in performance concerns, more research is often needed. You can identify some of these obvious indications of a DDoS assault using traffic analytics tools:
suspicious volumes of traffic coming from a single IP address or a group of IP addresses
a deluge of traffic from users who have the same device, location, or web browser version or who otherwise have a similar set of behaviour.
unexpectedly high demand for a particular page or endpoint
Unusual traffic patterns, such as spikes at unusual times of day or patterns that seem abnormal.
What are some common types of DDoS attacks?
Different DDoS attack types target various network connection components. Knowing how a network connection is established is required in order to comprehend how various DDoS assaults operate.
On the Internet, a network connection is made up of several separate parts or “layers.” Each layer in the model has a distinct role, much like constructing a house from the ground up.
Application layer attacks
The objective of these attacks, often referred to as layer 7 DDoS attacks (in reference to the 7th layer of the OSI model), is to deplete the target’s resources in order to produce a denial-of-service.
The layer where web pages are created on the server and transmitted in response to HTTP requests is the focus of the assaults. The cost of processing a single HTTP request is low on the client side, but the cost of responding on the target server’s end can be high since the server frequently loads several files and does database queries to generate a web page.
Protocol attacks
Protocol assaults, often referred to as state-exhaustion attacks, interrupt services by using up excessive server resources as well as those of network hardware such as firewalls and load balancers.
Protocol assaults make the target unreachable by taking advantage of flaws in layers 3 and 4 of the protocol stack.
An employee in a supply room taking requests from customers at the front of the business is an example of a SYN Flood.
After receiving a request, the employee goes to retrieve the box and waits for approval before carrying it outside. The employee then receives several additional shipment requests without confirmation up until they are unable to carry any more, are overburdened, and requests begin to go unanswered.
This attack sends a target a lot of TCP “Initial Connection Request” SYN packets with fictitious source IP addresses in an attempt to take advantage of the TCP handshake, the series of interactions by which two computers establish a network connection.
The target computer responds to each connection request, waits for the handshake’s last step, which never comes, and uses up all of the target’s resources.
SYN flood
An employee in a supply room taking requests from customers at the front of the business is an example of a SYN Flood.
After receiving a request, the employee goes to retrieve the box and waits for approval before carrying it outside. The employee then receives several additional shipment requests without confirmation up until they are unable to carry any more, are overburdened, and requests begin to go unanswered.
This attack sends a target a lot of TCP “Initial Connection Request” SYN packets with fictitious source IP addresses in an attempt to take advantage of the TCP handshake, the series of interactions by which two computers establish a network connection.
The target computer responds to each connection request, waits for the handshake’s last step, which never comes, and uses up all of the target’s resources.
You can also view our other blogs on cyber security by clicking here . See you in next blog till then keep learning with THEAX.
