Distributed denial of service or DDoS continues to be a major cyber problem. It is supposedly a straightforward threat that is mainly about exhausting the resources of a website or web app through overwhelming amounts of requests. However, many organizations still suffer from this attack.
A recent report shows that such cyber-attacks have been surging. The main reason for the sustained threat of DDoS is its evolution. Over the years, this attack has taken on new techniques and approaches to evade prevention and detection mechanisms.
Also, DDoS attackers are taking advantage of the growing adoption of relatively new technologies, which tend to expand attack surfaces and endpoints. If organizations were to successfully fend off DDoS attacks, they need to be proactive in addressing the evolution of DDoS attacks
The Evolution of DDoS
DDoS has come a long way since it was first used in actual attacks in the mid-1990s. It was originally used to flood a target system or online service with malicious traffic, employing a collection of compromised computers that made abnormal volumes of access requests until the target ran out of bandwidth or resources. This resulted in downtime, which made the website or online service unavailable to legitimate users.
As described, this attack is rather straightforward. Defeating it is similarly easy. The cybersecurity team of the attacked website only has to identify the IP addresses of the compromised computers and block them from sending more requests.
It is not that difficult to identify and block IP addresses because all devices have to present their IP addresses when establishing connections. Devices whose IP addresses appear to be making unusual amounts of requests can be blocked automatically.
However, DDoS perpetrators understand that their attacks can be easily deflected, so they improved their attack methodology through numbers. As people used more connected devices such as smartphones, tablets, IoT devices, and embedded systems, threat actors realized that they could make these usually poorly secured devices part of their DDoS botnets.
This means that the DDoS attacks will now come from a growing number of devices with new unique IP addresses. This makes it difficult to pinpoint which specific IP addresses to block since new IP addresses keep showing up.
Moreover, threat actors have learned to use reflection and amplification techniques, wherein they send requests to publicly accessible servers and spoof the victim’s IP address. This can cause the servers to correspondingly send out large responses to the reflected and amplified requests, leading to the rapid exhaustion of a web service’s resources.
Recently, DDoS attacks have focused on the application layer. With advanced tactics such as slow loris, HTTP floods, and Layer 7 protocol attacks, threat actors can undertake their distributed denial-of-service campaigns more stealthily and with greater impact.
Application layer attacks concentrate on vulnerabilities in the software operating on the target app or server to achieve more disruption with less traffic.
Responding in Kind
If attacks evolve, DDoS Protection services evolve as well. As DDoS continues to pose serious risks to organizations over the years, cybersecurity providers have been developing new methods to more efficiently detect and stop attacks.
Here’s a look at how these cyber defenses have improved to keep up with the growing aggressiveness and sophistication of DDoS attacks.
Traffic scrubbing – This has become a common DDoS mitigation technique and it particularly gained attention in 2018 when GitHub relied on it to address an attack that hit its servers with 126.9 million packets per second.
With traffic scrubbing, all incoming traffic is redirected to multiple data centers so it can be “scrubbed” to make sure that only legitimate traffic goes to the target destination.
Granular behavioral analysis – Cyber defenses often rely on threat intelligence to identify attacks. In the case of DDoS, organizations may obtain information about IP addresses that are being used for denial-of-service attacks, so specific devices are automatically prevented from making malicious requests.
However, given the fast-growing number of new connected devices that may be compromised and used in DDoS attacks, it is inexpedient to rely on threat signatures (DDoS IP addresses) to counter attacks.
To make up for this weakness, methods to analyze network traffic have been developed. DDoS prevention solutions can examine various factors such as the geographic origin of the requesting devices, usage behavior, rate of requests, and times.
It is possible to determine the onset of a DDoS attack by, for example, looking at the times or locations of the requests and comparing them to the pertinent details of the usual traffic a website receives. This makes it possible to detect and prevent an attack without earlier knowledge about malicious IP addresses.
Border Gateway Protocol (BGP) Anycast networks – BGP Anycast addressing can be used to undertake DDoS attacks. However, BGP Anycast networks, the infrastructure that supports BGP Anycast addressing, may be used to defend against DDoS. These networks can be used to automatically distribute incoming traffic to several data centers, spreading the load of the attack and preventing downtime.
It is similar to traffic scrubbing in using multiple servers, but it does not entail any traffic cleanup or filtering. Still, it is an effective way of mitigating the impact of an attack while the organization looks for a better solution.
Artificial intelligence – AI dramatically enhances granular behavioral analysis by autonomously learning from historical data on various DDoS attacks. It also focuses on analyzing network traffic and user behaviors.
However, instead of having fixed rules or configurations, an AI-enhanced DDoS defense system learns to adapt to attacks on its own. It can automatically adjust its detection and mitigation mechanisms in response to new attack patterns. AI significantly accelerates attack detection and rapidly deploys countermeasures.
Hybrid and multilayered approach – Modern DDoS protection solutions are designed to bring together on-premises tools and cloud-based resources to address all possible vulnerabilities under a scalable hybrid protection system.
Also, they integrate other effective modern techniques such as the use of traffic scrubbing data centers and behavioral analysis. Traffic is scanned and analyzed in various stages to make sure that if one security control fails, there will be others to spot and arrest the attack.
Conclusion
The evolution of cyber threats is a given, especially for DDoS which is not as sophisticated as other attacks. It continues to adopt new strategies to evade existing detection and prevention solutions. What’s reassuring to know is that cybersecurity solution providers tirelessly develop new solutions to address the changes in DDoS attacks.
Effective tools against DDoS are readily available. Organizations have no excuse to be unprepared for this persistent threat. It is important to choose and appropriately use the right DDoS solutions. Also, it is important to watch out for other cyber attacks that may be used alongside or in concert with DDoS, like in attacks where DDoS is used as a smokescreen for a more critical attack.
