Distributed Denial of Service (DDoS) attacks remain a persistent threat to websites, applications, services and network infrastructure. These attacks are designed to disrupt normal operations by overwhelming a target with excessive traffic, requests or connection attempts, preventing legitimate users from accessing the service.
DDoS attacks can take many forms and target different layers of infrastructure. Understanding the different types of DDoS attacks, their characteristics and how they operate is an important part of building an effective DDoS defence strategy.
Common Types of DDoS Attacks
DDoS attacks can target network capacity, transport protocols, applications and supporting infrastructure such as DNS. They may also combine multiple attack vectors in a single campaign.
Network and Protocol Attacks
SYN Flood:
A SYN flood exploits the TCP handshake process by sending large numbers of SYN requests to a target. This can consume connection resources and prevent the server from accepting legitimate connections.
UDP Flood:
A UDP flood sends a high volume of User Datagram Protocol (UDP) packets to the target, potentially consuming network bandwidth and processing resources and causing service disruption.
ICMP Flood:
An Internet Control Message Protocol (ICMP) flood sends large numbers of ICMP packets, such as echo requests, to consume available bandwidth or processing capacity.
Application Layer DDoS Attacks
Application layer attacks target applications and services rather than relying primarily on high bandwidth volumes. Because malicious requests may resemble legitimate user activity, these attacks can be more difficult to identify and mitigate.
HTTP Flood
An HTTP flood sends a large number of HTTP requests to a web server or application. These requests may imitate legitimate user behaviour while consuming application, database or server resources.
Slowloris
Slowloris attempts to maintain a large number of open HTTP connections by sending data very slowly. This can consume available connection resources and prevent legitimate users from establishing new sessions.
RUDY
RUDY, or R-U-Dead-Yet, is a slow HTTP POST attack that sends request body data at a very low rate. By keeping multiple connections open for extended periods, the attack can consume server resources and reduce service availability.
Amplification Attacks
Amplification attacks abuse publicly accessible services to generate significantly larger amounts of traffic towards a target. Attackers typically use spoofed source IP addresses so that responses from third-party systems are sent to the intended victim.
Common amplification techniques include:
DNS Amplification:
Attackers send DNS queries using a spoofed source IP address, causing DNS servers to send responses to the target. When responses are significantly larger than the original requests, traffic volumes can be amplified.
NTP Amplification:
Network Time Protocol (NTP) services can be abused to generate larger responses towards a target using spoofed requests.
SNMP Amplification:
Simple Network Management Protocol (SNMP) services may also be abused to generate response traffic towards a victim.
Botnet-Based DDoS Attacks
A botnet is a network of compromised devices controlled by an attacker. Botnets allow DDoS traffic to originate from many distributed IP addresses and geographic locations, making attacks more difficult to block using simple source-based filtering.
Mirai Botnet
Mirai became widely known for compromising Internet of Things (IoT) devices and using them to build large botnets capable of generating significant DDoS traffic.
BASHLITE
BASHLITE is malware associated with compromised Linux-based devices, including IoT systems. Infected devices can become part of botnets used to generate DDoS traffic.
Reaper Botnet
Reaper targets vulnerable IoT devices by exploiting software vulnerabilities rather than relying solely on default or weak credentials. Compromised devices can then become part of a larger botnet infrastructure.
IoT-Related DDoS Attacks
The rapid growth of Internet of Things devices has introduced additional opportunities for attackers. Poorly secured or vulnerable IoT devices can be compromised and incorporated into botnets or abused through exposed network protocols.
SSDP Amplification
Simple Service Discovery Protocol (SSDP) is used by devices to discover services on a network. Exposed SSDP services can be abused to generate amplified traffic towards a target.
CoAP DDoS
Constrained Application Protocol (CoAP) is a lightweight protocol commonly associated with resource-constrained and IoT environments. Exposed or vulnerable CoAP services may be abused as part of DDoS activity.
DNS-Based Attacks
The Domain Name System (DNS) is a critical component of internet infrastructure, making DNS services an attractive target for attackers. Disrupting DNS availability can prevent users from reaching applications even when the underlying services remain operational.
DNS Flood
A DNS flood sends a high volume of DNS queries to DNS infrastructure in an attempt to exhaust processing capacity or network resources and prevent legitimate domain resolution requests from being served.
DNS Random Query Flood
A DNS random query attack generates large numbers of queries for varying or randomised domain names or subdomains. This can increase processing requirements and reduce the effectiveness of caching mechanisms.
DNS Spoofing
DNS spoofing is not itself a DDoS technique, but it represents another form of attack against DNS infrastructure. It involves manipulating DNS information so that users may be redirected to unintended or malicious destinations.
The Evolving DDoS Threat Landscape
DDoS attacks continue to evolve in scale, complexity and technique. The expansion of IoT ecosystems, cloud infrastructure and interconnected services has created additional attack surfaces while allowing attackers to combine network, protocol and application layer techniques.
Modern DDoS campaigns may also use multiple attack vectors simultaneously or switch between techniques in an attempt to bypass mitigation controls.
Organisations should therefore combine robust security controls, continuous monitoring, effective mitigation strategies and regular DDoS resilience testing. Understanding the different types of DDoS attacks is an important first step towards identifying weaknesses, validating defensive controls and improving preparedness against real-world attacks.
