Different types of DDOS attacks

Different types of DDOS attacks

First-name Surname1*, Second-name Surname2, and Third-name Surname3

1Affiliation 1, Email address, University, City, Country 2Affiliation 1, Email address, University, City, Country 3Affiliation 1, Email address, University, City, Country

*Corresponding Author

ABSTRACT

This paper analyses different types of DDOS attacks while presenting the most effective measures for detecting and mitigating such attacks. The content acknowledges faults in some mitigation measures, therefore allowing the reader and future researchers to identify weaknesses of different techniques. The study also includes a diagram to illustrate how DDOS attacks are launched. Finally, the research outlines the essential elements of handling DDOS attacks, thus creating an opportunity for future researchers to enhance knowledge on the topic.

Introduction

A denial of service can be defined as a malicious act aimed at preventing legitimate users from accessing specific websites and web services. On the other hand, a Distributed Denial of Service (DDOS) is a coordinated attack targeting the availability of services on a network or system. In this case, the services affected by the attack are referred to as primary victims, while the compromised systems used to launch the attack are known as secondary victims.

The distributed denial of service is distributed using the target computer systems, hence making it difficult for forensics to track. The attacker uses many computers as attack platforms and is, therefore, able to multiply the effectiveness of the attack on target systems or networks. In February 2000, Yahoo.com became a victim of a DDOS attack that lasted nearly two hours. As a result, Yahoo.com suffered a revenue loss of up to $500,000 attributed to advertising. The contribution of this paper is to analyze the types of DDOS attacks, their targets, and motivation as well as preventive and mitigation measures (Vlajic & Zhou, 2018).

Figure 1. An illustration of a DDOS attack

Targets and motivation of DDOS attacks

The arbor network tracks an estimate of 1000 different DDOS attacks every day around the world. According to the network, the attacks range from user to government or even e-commerce organizations and banks. While some attacks are motivated by financial gains, other attacks can be designed to target political organizations or internet service providers.

Today, attacks motivated by financial gains are launched by well-experienced perpetrators, thus making it difficult to mitigate. Consequently, DDOS attacks can be targeted on an organization or system for purposes of revenge. Additionally, a DDOS can be launched as apart of cyber warfare. In this scenario, such an attack imposes significant economic impacts on the target systems or organization. Given the number of resources and time used to launch such DDOS attacks, the perpetrators are sponsored by a country’s government.

Types of DDoS attacks

In order to develop a mitigation measure for DDOS attacks, it is essential to identify different classifications of DDOS attacks. The DDOS attacks are categorized according to the effects of the attack on the target’s networks or resources.

Resource depletion attacks

The goal of this attack is to destroy the major components of the systems, including the CPU, sockets, and memory. The resource depletion attacks can be performed using two techniques, including exploiting the network, transport and application protocols, or using malformed packets (Somani et al. 2017).

Protocol exploit attacks

In this scenario, the perpetrator identifies and exploits weaknesses in the network protocols to launch the attack. Attacks in this category exploit transmission control protocol as well as application layer protocols.

SIP flood attack

This type of DDOS attack exploits an application layer protocol known as SIP. As a result, the attack can be launched using various SIP requests, including SIP INVITE and SIP INFOR.

Preventive measures against DDOS attacks

The prevention stage of DDOS attacks is essential to protect victims from losses. Since DDOS attacks target systems and networks, a successful attack can cause huge losses of resources. The prevention of DDOS attacks plays a crucial role in managing the attack load before it escalates into an attack on the victim’s systems and networks. Given the constantly increasing DDOS attacks, it is essential for users to adopt effective prevention measures against such attacks.

Prevention using filtering

The filtering technique prevents attack traffic from accessing the systems as well as ensuring legitimate traffic has access to the networks. There are various filtering techniques, including route-based packet filtering, history-based filtering, as well as hop-count filtering.

Preventing using secure overlay

This preventive mechanism secures the subsets of networks within the systems. This technique involves building an overlay network on top of an ip network. This achieved by introducing a firewall to block unauthorized traffic into the ip network. While this measure may be appropriate for preventing DDOS attacks in private networks, it is ineffective in public servers.

Honeypots

A honeypot is a prevention mechanism that prevents DDOS attacks by directing the attack traffic to the wrong system. In this scenario, the perpetrator proceeds with the attack thinking they are targeting the actual systems. The honeypot technique allows the user to extract important data from the attacker that can be utilized in revealing the true identity of the perpetrator.

DDOS mitigation

Mitigation measures against DDOS attacks involve three different mechanisms, including detection, response, and tolerance.

Detection

While it may be challenging to differentiate between legitimate and suspicious flow, detection is the most important part of mitigation. In this scenario, the detection measures incorporate two different techniques including;

Signature-based detection

This detection technique monitors signatures to differentiate between a normal and a malicious one. While this technique is effective, it may not identify already existing attacks.

Anomaly-based detection

An anomaly detection technique detects attacks by identifying new signatures attributed to perpetrators. As such, the technique involves selecting traffics according to the traffic statistics acquired during the monitoring process (Najafabadi et al. 2017)

Response

After the DDOS attack has been detected, it is essential to respond to the attack within the shortest time possible. An effective response can help reduce the impacts of the attack on the victim’s systems. In a scenario where the detection mechanism identifies the attack flow, it is appropriate to use filtering to prevent the spread of the attack.

Tolerance

This mechanism is designed to act as an alternative to the detection technique. As such, this technique works to reduce the impacts of the DDOS attack. In this scenario, the tolerance mechanism attempts to replicate the system resources, including the software (Bawany et al. 2017).

Discussion and Conclusion

While various studies have been conducted on DDOS attacks, the technological advance has led to the rise of advanced DDOS attacks that require modern mitigation mechanisms. Throughout the paper, the studies conducted by previous researchers have been analyzed. While DDOS attacks may occur without the knowledge of the victim, use of IoT botnets can help in detecting such attacks (Kolias et al. 2017)

Given the immense loss of resources caused by DDOS, ensuring the effectiveness of the defense mechanisms is critical for organizations. The study analyses different types of DDOS attacks based on their motivation and target. Additionally, well-known prevention and mitigation techniques have been addressed in the paper. The paper has identified the detection and response measures while outlining their weaknesses. The content presented in this study will be helpful to future researchers.

Acknowledgments

I wish to thank my classmate for providing me with finding research material.

References

1. Bawany, N. Z., Shamsi, J. A., & Salah, K. (2017). DDoS attack detection and mitigation using SDN: methods, practices, and solutions. Arabian Journal for Science and Engineering, 42(2), 425-441.
2. Kolias, C., Kambourakis, G., Stavrou, A., & Voas, J. (2017). DDoS in the IoT: Mirai and other botnets. Computer, 50(7), 80-84.
3. Najafabadi, M. M., Khoshgoftaar, T. M., Calvert, C., & Kemp, C. (2017, August). User behavior anomaly detection for application layer DDOS attacks. In 2017 IEEE International Conference on Information Reuse and Integration (IRI)(pp. 154-161). IEEE.
4. Somani, G., Gaur, M. S., Sanghi, D., Conti, M., & Buyya, R. (2017). DDoS attacks in cloud computing: Issues, taxonomy, and future directions. Computer Communications, 107, 30-48.
5. Vlajic, N., & Zhou, D. (2018). IoT as a land of opportunity for DDoS hackers. Computer, 51(7), 26-34.