Types of DDoS Attack
A distributed denial-of-service (DDoS) attack is a type of cyberattack in which multiple compromised systems are used to target a single system, usually with the goal of overwhelming its resources and making it unavailable to its users.
There are three primary categories of DDoS attacks: volumetric, protocol, and application.
| Volumetric Attacks | Protocol Attacks | Application Attacks | |
|---|---|---|---|
| What is it? | Attacks that use a massive amount of traffic, saturating the bandwidth of the target. Volumetric attacks are easy to generate by employing simple amplification techniques. | Attacks that render a target inaccessible by exploiting a weakness in the Layer 3 and Layer 4 protocol stack. | Attacks that exploit a weakness in the Layer 7 protocol stack. The most sophisticated of attacks and most challenging to identify/mitigate. |
| How does it cripple the target? | The sheer quantity of traffic generated by the attack can completely block access to the end resource (a website or a service). The magnitude of the attack is commonly measured in bits or packets per second. | Protocol attacks consume all the processing capacity of the attacked target or intermediate critical resources like a firewall, causing service disruption. | Application attacks establish a connection with the target and then exhaust the server resources by monopolizing processes and transactions. |
| Examples | NTP Amplification, DNS Amplification, UDP Flood, TCP Flood | Syn Flood, Ping of Death | HTTP Flood, Attack on DNS Services |
Volumetric
Volumetric attacks are the most common type of DDoS attack. They work by flooding the target with traffic until it can no longer cope with the volume of incoming requests and becomes overwhelmed. There are several volumetric attacks, including UDP flood attacks, CharGEN flood, ICMP (Ping) flood, ICMP fragmentation flood, and misused application attacks.
Protocol
Protocol attacks exploit vulnerabilities in the protocols themselves to cause a denial of service condition. The most common type of protocol attack is the SYN flood attack. Other protocol attacks include TCP flood attacks, session attacks, slowloris, ping of death, smurf attacks, fraggle attacks, Low Orbit Ion Cannon (LOIC), and High Orbit Ion Cannon (HOIC).
Application
Application attacks target vulnerabilities in specific applications or services running on a server. The most common type of application attack is the HTTP Flood attack.