Distributed Denial of Service (DDoS)

Distributed Denial of Service (DDoS) is a type of cyber attack which attempts to take a network resource, website, or service, offline, by overwhelming it with malicious traffic from multiple sources. DDoS is a type of Denial of Service (DoS) attack, where malicious actors use multiple computers to send large amounts of data to a single server or website, in order to overwhelm it with requests, so it can no longer respond to legitimate requests.

The aim of a DDoS attack is to cause extreme disruption and render the target resource unavailable to legitimate users and services. It is often used by malicious actors to extort a ransom, seek revenge, or cause reputational damage. DDoS attacks can be performed with the intent to take down a website or server, or they can be more sophisticated attacks, targeting multiple systems to compromise an entire network.

No single computer system is capable of generating enough malicious traffic to overwhelm an entire network, so this type of attack typically requires what is known as a Distributed Denial of Service (DDoS) “botnet”. A botnet is a network of computers infected with malicious software (malware) that allows attackers to control a large group of computers to flood targets with malicious traffic.

There are several categories of DDoS attack types, each of which is performed in a slightly different way. Common DDoS attack vectors include “volumetric” or “bandwidth” attacks, where large amounts of data are sent to overwhelm the target; “application” or “layer 7” attacks, which use legitimate protocols and application-level requests to overload resources; and “protocol” or “infrastructure” attacks, which target layer 3 or layer 4 of the OSI network model.

DDoS attacks can also vary in their intensity and duration, ranging from short-term event-based attacks which last for a few hours or days, to prolonged or sustained attacks with a much higher bandwidth.

Organizations can defend against DDoS attacks by deploying DDoS protection services such as firewalls, intrusion detection systems, rate-limiting measures, and attack mitigation techniques. Making sure to keep system patches, networks, and applications up to date can also help prevent attackers from exploiting vulnerable or outdated systems.