Distributed Denial of Service (DDoS) Attacks

Classification, Attacks, Challenges and Countermeasures

Brij B. Gupta, Amrita Dahiya

• Publisher: CRC Press
• Year: 2021
• Print ISBN: 9780367619749
• eBook ISBN: 9781000347098
• Topic: Computer Science
• Subtopic: Cloud Computing
• Index: Computer Science

The complexity and severity of the Distributed Denial of Service (DDoS) attacks are increasing day-by-day. The Internet has a highly inconsistent structure in terms of resource distribution. Numerous technical solutions are available, but those involving economic aspects have not been given much consideration. The book, DDoS Attacks – Classification, Attacks, Challenges, and Countermeasures, provides an overview of both types of defensive solutions proposed so far, exploring different dimensions that would mitigate the DDoS effectively and show the implications associated with them.

Features:

• Covers topics that describe taxonomies of the DDoS attacks in detail, recent trends and classification of defensive mechanisms on the basis of deployment location, the types of defensive action, and the solutions offering economic incentives.
• Introduces chapters discussing the various types of DDoS attack associated with different layers of security, an attacker's motivations, and the importance of incentives and liabilities in any defensive solution.
• Illustrates the role of fair resource-allocation schemes, separate payment mechanisms for attackers and legitimate users, negotiation models on cost and types of resources, and risk assessments and transfer mechanisms.

DDoS Attacks – Classification, Attacks, Challenges, and Countermeasures is designed for the readers who have an interest in the cybersecurity domain, including students and researchers who are exploring different dimensions associated with the DDoS attack, developers and security professionals who are focusing on developing defensive schemes and applications for detecting or mitigating the DDoS attacks, and faculty members across different universities.

Fundamentals of DDoS Attack: Evolution and Challenges1

Substantial development in technology and digitization is constantly extending the world to new milestones and even more difficult challenges. Cutting-edge technologies like Internet of Things (IoT), cloud computing, blockchain, and many other are capable of pushing, enhancing, and automating the lives of people. However, at the same time, these technologies have added fuel to the fire by appending a long list of vulnerabilities and challenges to the existing perils of Internet. People and businesses have constantly been trapped through attacks and threats by attackers [1]. Further, businesses become more dependent on web connectivity for delivery of services, to carry out critical business operations, and to sustain in the market. All these factors contribute immensely to the daunting growth rate of cyberattacks and threats. A Distributed Denial of Service (DDoS) attack is one of the most common types of cyberattacks and has existed since 1974. It still continues to be a major concern for businesses and security professionals. Therefore, this chapter concentrates on comprehensive details of architecture, variants, evolution, and the challenges of DDoS attacks. Further, this chapter covers recent trends and statistics from reliable sources. It will provide readers deep insights into the security threats corresponding to different variants of DDoS attacks.

1.1 DDoS ATTACK: FUNDAMENTALS

A DDoS attack is a massive, distributed, deliberated, and coordinated attack by multiple compromised machines to overwhelm an online service or a server. Attackers attempt to attack the availability of the service by sending voluminous dummy data to make target machine fall short of resources [2]. There exists a huge misalignment of resources as well as of incentives on the Internet, which provides an easy path for attackers to carry out a DDoS attack. A DDoS attack is a variant of Denial of Service (DoS) attack, where the difference lies in the dispersion of attacking source. In DDoS attack, malicious traffic is generated from multiple distributed sources, while in DoS attack, attack is only from a single source [3]. In this attack, the traffic sent by individual bot machines is not huge enough to disrupt the availability of a service, but it is the result of cumulative effect of efforts made by several bot machines. Attackers usually create a network of compromised machines, i.e., botnet by secretly inserting malicious scripts into them. After taking control of the machines, attackers send spam, distribute malware, and tend to attack other systems by exploiting compromised machine. Apart from this method, attackers tend to exploit vulnerabilities of layers 3, 4, and 5 protocols of Open Systems Interconnection (OSI) reference model, which will be discussed later in this chapter. During early days, this attack was only meant to run a certain set of malicious scripts. But technological advancements and constantly increasing incentives have always placed attackers ahead of defenders. The DDoS attack is a significant risk to online businesses, as few minutes of downtime can have serious repercussions like financial or reputational loss [4]. Now, we will discuss the statistics and recent trends, architecture, and types of DDoS attacks.

1.1.1 Statistics and Recent Trends

The established vulnerabilities and the existing botnets have continuously been explored and exploited by the attackers. The moment a new vulnerability is marked, attackers start working on launching a new series of DDoS attacks by exploiting it. The DDoS attack has always been a preferable choice of attackers, as its mitigation is not as easy as its instigation. The largest DDoS attack, of size 1.7 Tbps, was carried out against Github in 2018 (Figure 1.1) [5]. This attack was considered as the largest attack in history until even more disastrous attack of 2019 joined the race. An unnamed client of Imperva had suffered a DDoS attack with a size of 500 million packets per second. Afterwards, the same client had survived an attack with a size of 580 million packets per second in the second quarter of 2019 [6]. Github in 2018 had endured 129.6 million packets per second. Therefore, it can be seen here that in 2019, this attack was almost four times larger than that in 2018.

FIGURE 1.1The largest DDoS attack recorded each year. (Arbour Network Inc.)

According to Cisco Visual Networking Index (VNI), by 2022, the number of DDoS attacks will rise up to 14.5 million and may represent 25% of a country's total Internet traffic [7]. Another important trend in this domain is the usage of multi-vector DDoS attack against a single target. In a multi-vector DDoS attack, an attacker tends to merge multiple variants of DDoS attack to not leave any scope for target's survival [8]. Apart from this, another important trend is the usage of “low intensity incursions” that steadily degrade the performance of the target machine over time. These types of attack empower longer attacks that...

Table of contents

• Cover
• Half Title
• Title Page
• Copyright Page
• Dedication
• Contents
• Preface
• Acknowledgements
• About the Authors
• 1 Fundamentals of DDoS Attack: Evolution and Challenges
• 2 Role of Incentives, Liabilities, and Cyber Insurance
• 3 Taxonomy of DDoS Defence Mechanisms
• 4 Taxonomy of Economical Solutions
• 5 DDoS Attacks on Various Platforms
• 6 Emerging Solutions for DDoS Attack: Based on SDN and Blockchain Technologies
• Index