DDOS Attack-Types And Ways To React To Them ?

Distributed Denial of Service Attacks (DDoS) attempts to render a computer or a cyber-service unavailable by flooding it with traffic from various sources. The objective is often to force the computer(s) in issue to suspend administration by employing the capabilities of many hosts to disrupt its rush-hour congestion stream. To fully grasp the concept of DDoS, imagine when vehicles are diverted from a congested route to a mostly empty roadway.

The route, which was initially designed for a limited number of cars, now requires more than its capability. This delays vehicle and human movement advancement or complete cessation of movement on the impacted path. This is precisely what happens during a DDoS attack. When a framework becomes overburdened with traffic from several sources concurrently, it ceases to function.

Types of Attacks

There are several sorts of distributed denial-of-service attacks that may wreak havoc on targeted enterprises. We classify assaults into three categories in this article: volumetric, protocol, and application attacks while noting that the lines between the three categories are unclear. Often, attackers may exploit all three types simultaneously to maximise the disruption of their attacks.

1. Protocol Attacks

Protocol assaults are designed to exhaust all available resources on a target network/service by repeatedly sending it erroneous connection requests. A popular protocol attack is an SYN flood. The client computer sends an SYN request to the host during a standard three-way handshake that creates a connection between two computers. The host responds to the SYN request with an SYN-ACK message, and the client computer responds with an ACK message to establish the connection with the host. SYN floods are attacks in which a large number of SYN packets are delivered to each port of a targeted server using a faked IP address.

The host answers with an SYN-ACK, but the client does not react since the first SYN packets were faked. Eventually, the host computer’s ports will get saturated with half-opened connections, denying valid connection requests. Along with SYN floods, several additional related protocol assaults exist, such as Ping of Death, Smurf DDOS, and others. Protocol assaults are often measured in packets per second and utilise the processing resources of network equipment such as firewalls, load balancers, and servers (PPS).

2. Volumetric Attacks

The most prevalent and destructive type of DDOS assault is volumetric. A volumetric assault floods a network with network traffic, depleting the target organisation’s resources. In volumetric assaults, the attacker frequently employs a large number of malware-infected systems, referred to as bots, to strike an organisation. Volumetric assaults are frequently carried out using User Data gram Protocol (UDP) and Internet Control Message Protocol (ICMP) floods. UDP and ICMP are connection less protocols that enable rapid data delivery without relying on integrity checks, making them excellent targets for attackers.

Additionally, volumetric assaults frequently employ reflection and amplification techniques to overload the target network/service completely. For example, one sort of UDP volumetric assault is a Distributed Denial of Service (DDOS) attack using thousands of bots to fake a target system’s IP address while sending NTP queries to real NTP servers on the internet. As a result, a deluge of traffic from the NTP servers overwhelms the targeted system.

3. Application Layer Attacks

Program assaults are directed toward an organisation’s online applications, in which the attacker sends the application many seemingly valid processing requests. These attacks force the program to use CPU and memory resources until they are depleted, and the application is unable to respond to more requests.

For example, the operations of adding an item to a shopping basket and checking out are computationally costly for an e-commerce site. Attackers who bombard these application processes with concurrent requests might quickly deplete the target system’s resources and bring the server to a halt. Typically, application layer assaults are quantified in terms of requests per second (rps).

Read More : All You Need To Know About Ransomware

How is a DDoS assault mitigated?

Differentiating between attack and regular traffic is critical for mitigating a DDoS assault. For instance, if a company’s website is inundated with excited buyers following a product launch, blocking all traffic is a mistake.

On the other hand, if a business experiences an unexpected spike in traffic from known attackers, actions to mitigate the assault are almost always essential. The problem is in distinguishing genuine clients from assault traffic.

DDoS traffic may take on a variety of forms on the current internet. In addition, the traffic may be designed in a variety of ways, ranging from straightforward single source attacks to complicated and adaptive multi-vector attacks.

A multi-vector DDoS attack employs multiple attack vectors to overwhelm a target in various ways, potentially detracting from mitigation efforts focused on a single path. A multi-vector DDoS assault simultaneously targets multiple levels of the protocol stack, such as a DNS amplification attack (hitting layers 3/4) combined with an HTTP flood attack (targeting layer 7).

Mitigating a multi-vector DDoS assault involves diverse tactics to address the attack’s many vectors. Generally, the more complex the attack, the more difficult it will be to distinguish attack traffic from normal traffic – the attacker’s goal is to blend in as much as possible, rendering mitigation efforts inefficient.

Mitigation efforts include indiscriminately removing or reducing traffic risk displacing good traffic, and the attack may also alter and adapt to escape countermeasures. A layered approach will provide the most advantage in overcoming a complicated attempt at disruption.

Conclusion

Denial of service attacks are one of the most prevalent forms of cyber attacks in today’s society. Therefore, it is critical for every network administrator (or user) who want to surf the internet safely to be familiar with the fundamental kinds and how to fight against them. Apart from the protection tactics mentioned above, you may also engage professionals in the field of cyber security to ensure your safety. Above all, the goal is to protect your online experience from these types of threats.