DDoS Protection Technical Brief

How it works
Attack detection
Flow sampling overview
Protection against common DDoS attack types
See also

We offer a Distributed Denial-of-Service (DDoS) protection service to ensure that your network, websites, and servers are protected from malicious attacks aimed at overwhelming your infrastructure. This is part of our Network Cyber Services portfolio.

Our DDoS protection service is compatible with all Direct Internet (IPX) and Protected Internet (IPP) services.

DDoS attacks attempt to disrupt your services by flooding them with fake traffic, making it difficult for legitimate users to access your resources.

Our service triggers automatically ensuring that harmful traffic is dropped while allowing legitimate traffic to pass through unaffected. This results in minimal disruption to your operations during an attack.

How it works

Our service provides protection against all inbound and outbound connectivity.

We monitor traffic in real-time, identifying any unusual spikes or patterns that may indicate an incoming DDoS attack.

When malicious traffic is detected, we redirect it through our scrubbing devices to prevent it from reaching your infrastructure.

This filtering technology blocks malicious traffic while allowing legitimate traffic to continue to the intended destination.

Once the attack subsides, our system automatically reroutes traffic back to normal operation without any manual intervention.

Attack detection

We have an automatic detection system monitoring for suspicious traffic based on thresholds learned during the onboarding period and based on the use case for the protection.

In the unlikely event we do not detect the attack or involves a more complex application layer attack, we can place a manual mitigation and respond within SLA times.

If we detect an attack, we will proactively apply mitigations and provide a notification. If the attack is not detected, once reported, we will respond within the agreed SLA timeframe.

Flow sampling overview

Attack detection is based on sampled network flow data. Flow sampling involves analysing the packet meta data from a statistical sample of traffic transiting the core network (typically around 1 in every 1000 packets).

Rather than analysing every single packet, this meta data stream is forwarded to the analysis engine where attacks can be detected. This ensures that under normal circumstances, traffic flows experience no performance impact since the analysis is performed out-of-band.

Sampling a statistically significant amount of traffic is particularly effective when detecting DDoS attacks, since they tend to rapidly overwhelm all other traffic flows (and become the majority of all samples).

This method ensures a highly performant, real-time detection capability can identify attacks quickly.

Protection against common DDoS attack types

Volumetric
Protocol
Application

DDoS Protection Technical Brief

How it works

Attack detection

Flow sampling overview

Protection against common DDoS attack types

See also