Introduction to DDoS attacks
Distributed Denial of Service (DDoS) combines multiple computers as an attack platform, and uses malicious programs through remote connections to launch DDoS attacks on one or more targets, consuming target server performance or network bandwidth, resulting in The server cannot provide services normally.
Principle of Attack
Usually, an attacker uses an illegal account to install the DDoS master control program on one computer and install the agent program on multiple computers on the network. In the set time, the main control program communicates with a large number of agent programs. The agent program launches an attack on the target when receiving instructions. The main control program can even activate hundreds of agent programs within a few seconds.
The harm of DDoS attacks
DDoS attacks can cause the following harm to your business:
Heavy economic loss
After suffering a DDoS attack, your origin server may not be able to provide services, resulting in users unable to access your business, resulting in huge economic losses and brand losses.
For example: When an e-commerce platform is under a DDoS attack, the website cannot be accessed normally or even temporarily shut down, causing legitimate users to be unable to place orders to purchase goods, etc.。
Data breach
When hackers conduct DDoS attacks on your server, they may take the opportunity to steal the core data of your business.
Malicious competition
Vicious competition exists in some industries. Competitors may maliciously attack your services through DDoS attacks to gain an advantage in industry competition.
For example, a game business suffered a DDoS attack, and the number of game players dropped sharply, resulting in the game business being quickly and completely offline within a few days.
Common types of DDoS attacks
DDoS attack classification
Attack subclass
Description
Malformed message
Malformed packets mainly include Frag Flood, Smurf, Stream Flood, Land Flood, IP malformed packets, TCP malformed packets, UDP malformed packets, etc.
Malformed packet attack refers to the purpose of denial-of-service attack by sending defective IP packets to the target system, causing the target system to crash when processing such packets.
Transport layer DDoS attack
Transport layer DDoS attacks mainly include Syn Flood, Ack Flood, UDP Flood, ICMP Flood, RstFlood, etc.
Take the Syn Flood attack as an example. It uses the three-way handshake mechanism of the TCP protocol. When the server receives a Syn request, the server must use a listening queue to save the connection for a certain period of time. Therefore, by continuously sending Syn requests to the server, but not responding to Syn+Ack messages, the resources of the server are consumed. When the listening queue is full, the server will not be able to respond to requests from normal users, achieving the purpose of denial of service attacks.
DNS DDoS attack
DNS DDoS attacks mainly include DNS Request Flood, DNS Response Flood, fake source + real source DNS Query Flood, authoritative server attack, and local server attack.
DNS DDoS attacks mainly include DNS Request Flood, DNS Response Flood, fake source + real source DNS Query Flood, authoritative server attack, and local server attack.
Connected DDoS attacks
Connected DDoS attacks mainly refer to TCP slow connection attacks, connection exhaustion attacks, Loic, Hoic, Slowloris, Pyloris, Xoic and other slow attacks.
Take the Slowloris attack as an example. The target of the attack is the concurrency limit of the Web server. When the number of concurrent connections to the Web server reaches the upper limit, the Web service cannot accept new requests. When the web service receives a new HTTP request, it establishes a new connection to process the request, and closes the connection after the processing is complete. If the connection is always connected, a new connection needs to be established for processing when a new HTTP request is received. When all connections are in the connected state, the Web will not be able to process any new requests. The Slowloris attack uses the characteristics of the HTTP protocol to achieve the purpose of the attack. The HTTP request ends with \r\n\r\n. If the Web server only receives \r\n, it is considered that the HTTP Headers part is not over, and the connection will be retained and the subsequent request content will be awaited.
Web application layer DDoS attack
Web application layer attacks mainly refer to attacks such as HTTP Get Flood, HTTP Post Flood, and CC.
Generally, application layer attacks completely simulate user requests, similar to various search engines and crawlers. These attacks have no strict boundaries with normal businesses and are difficult to distinguish.
Some resource-intensive transactions and pages in Web services. For example, for paging and table splitting in Web applications, if the parameters of the control page are too large, frequent page turning will occupy more Web service resources. Especially in the case of high concurrency and frequent calls, transactions like this have become the target of early CC attacks.
Since most of the current attacks are mixed, frequent operations that simulate user behavior can be considered as CC attacks. For example, visits to websites by various ticketing software are, to some extent, CC attacks.
The CC attack is aimed at the back-end business of Web applications. In addition to causing denial of service, it also directly affects the functions and performance of Web applications, including Web response time, database services, disk read and write, etc.
Some resource-intensive transactions and pages in Web services. For example, for paging and table splitting in Web applications, if the parameters of the control page are too large, frequent page turning will occupy more Web service resources. Especially in the case of high concurrency and frequent calls, transactions like this have become the target of early CC attacks.
Since most of the current attacks are mixed, frequent operations that simulate user behavior can be considered as CC attacks. For example, visits to websites by various ticketing software are, to some extent, CC attacks.
The CC attack is aimed at the back-end business of Web applications. In addition to causing denial of service, it also directly affects the functions and performance of Web applications, including Web response time, database services, disk read and write, etc.
How to judge whether the business has been attacked by DDoS?
When the following situations occur, your business may have been attacked by DDoS:
When the network and equipment are normal, the server suddenly experiences disconnection, access freezes, and user disconnection.
The server CPU or memory usage has increased significantly.
The outbound or inbound traffic of the network has increased significantly.
Suddenly a large number of unknown visits to your business website or application.
Login to the server failed or was too slow.
