Types of DDOS Attacks – What Are They & How Do They Work?
DDOS attack types: Individuals and businesses around the world using the internet for their work are always at risk of cyberattacks. These attacks come in several forms depending on the underlying goal. Cyberattackers generally want to steal data.
However, at times, they also aim to make your resources inaccessible for some time. They perform a DDoS attack for this purpose. This type of attack is quite prevalent, affecting a large number of companies worldwide every year.
Below, we explore some common types of DDoS attacks and how they work so that you can take appropriate measures to prevent them and protect your network.
On this page:
What are DDoS Attacks?
A Distributed Denial of Service (DDoS) attack is an attempt to overload a server with massive fake traffic to make the site inaccessible. The attacker, in this type of cyberattack, tries to make the resources of a database or server unavailable to users by sending millions of requests through compromised devices called botnets. Such an attempt overwhelms the resources and crashes the servers.
DDoS attacks are different from other cyberattacks as it does not breach the network or steal any data. It only aims to make a website’s resources unavailable to genuine users.
Attackers choose this form of cyberattack to affect a company’s online database and gain visibility, thereby causing financial and reputational loss to it.
A DDoS attack is also often used as a smokescreen for a ransomware attack or a data breach.
Types of DDoS Attacks
Broadly speaking, DDoS attacks can be classified into three categories, as discussed below.
Volume-Based Attack
This type of attack is the most widespread DDoS attack. It focuses on hogging the bandwidth of the server by sending a high volume of requests from a number of devices. The traffic blocks requests coming from legitimate users trying to access the website.
A volume-based attack is also the most dangerous one.
Protocol Attack
Protocol-based attacks aim to consume a server’s resources and specifically target load balancers and firewalls. Compromised devices send a large number of connection requests to the server to exhaust all its available resources.
This results in the depletion of resources at the server so that it can no longer serve the requests of genuine users.
Application Layer Attack
This type of DDoS attack is relatively sophisticated and targets system-level vulnerabilities in applications and operations. In such an attack, the cybercriminal mimics the behavior of a legitimate user and sends requests that seem genuine.
They target specific features of certain applications to stop them from delivering information to users and hog the bandwidth up to the point that the system crashes. However, as the attack only targets specific features, they may even go unnoticed.
Subtypes of DDoS Attacks
While DDoS has three broad categories, they also have several subtypes, as discussed below.
DNS Flood Attack
This is where a cybercriminal attacks the DNS of a network or the company. They aim to keep the DNS from mapping IP addresses with site requests, thereby preventing users from accessing the webpage they want.
Ping of Death Attack
Ping of Death (PoD) attack is where the attacker sends oversized packets of data to crash a server or application. As the machine tries to reconstruct the packets, the size crosses the limit and results in the device crash.
HTTP Flood Attack
In this DDoS attack, the cybercriminal floods the network or device with spoofed HTTP requests. You will waste resources responding to these requests, and legitimate requests will not be able to access the resources.
UDP Flood Attack
It is any DDoS attack that aims to flood the target with User Datagram Protocol packets. The objective is to overwhelm the ports of the target device.
The host constantly checks the application listening at that port, exhausting its resources and resulting in inaccessibility.
SYN Flood Attack
This type of attack targets a known weakness in the TCP connection sequence where the host tries to establish a connection with the server. As more packets are sent, the server is overloaded in responding to them.
NTP Amplification Attack
In this type of attack, the exploiter targets accessible NTP servers and overwhelms them with UDP traffic.
As the server responds to these requests, the traffic eventually increases, and the quality of legitimate service degrades.
ICMP Flood Attack
Just like a UDP flood attack, an ICMP flood attack overloads the target by sending ICMP Echo requests at speed without waiting for a response.
Such an attack takes up incoming as well as outgoing bandwidth as the servers attempt to respond with reply packets, causing an overall system slowdown.
SSDP Attack
This is a type of DDoS attack where the cybercriminal uses the UPnP networking protocol to send massive traffic to the targeted device. It not only overwhelms the infrastructure of the target but also takes the website down.
Low and Slow Attack
It is a DDoS attack that works differently from others. In this attack, the attacker targets a specific application or resource through a small stream of slow traffic. This type of attack cannot be easily identified as it doesn’t show up on monitoring tools.
A low and slow attack generally goes unnoticed and keeps consuming resources, affecting the performance of the site.
Ransom DDoS Attack
Ransom attackers can threaten organizations with a DDoS attack to extort money. They often attack one feature of an application to demonstrate the damage they can cause if not given money.
QUIC Flood Attack
The QUIC (Quick UDP Internet Connections) transport layer has built-in encryption, which makes it more secure than TCP and more trustworthy than UDP.
However, when an overwhelming number of requests are sent through it, it can take time for encryption, slowing down access to genuine users. This is how a cybercriminal executes this type of DDoS attack.
How to mitigate DDoS attacks
Many organizations believe that their businesses will not be targeted by cybercriminals. Businesses can incur up to $120,000 in losses for each DDoS assault; therefore, your website is vulnerable to hackers, and you should endeavor to improve its security.
Here are some measures you may take to safeguard your website or web applications from various sorts of DDoS assaults and keep your website available at all times.
Increase bandwidth
Making your hosting infrastructure “DDoS robust” is one of the most fundamental precautions you can take against DDoS attacks. This entails preparing sufficient bandwidth to withstand traffic spikes that may result from cyber assaults.
Please note, however, that acquiring additional bandwidth is insufficient as a full solution for mitigating DDoS assaults.
Increasing bandwidth raises the bar that attackers must clear before launching a successful DDoS assault, but you should always combine this with additional mitigation strategies to fully protect your website.
Leverage a CDN Solution or Multi CDN
CDN providers provide cybersecurity features and solutions to defend your website. Free SSL certificates are offered. When you join your website to these service providers, it provides DDoS protection to mitigate server network and application attacks.
All malicious requests targeting L3/L4 that aren’t accessible over ports 80 and 443 will be blocked out automatically by a CDN’s port protocol.
Using a CDN may balance website traffic to prevent server overload. CDNs split your traffic over several servers, making it harder for hackers to target your original server.
With a Multi CDN solution, you may employ a vast network of PoPs from different CDN providers, allowing your website to withstand DDoS attacks via a bigger, multi-terabit-per-second network.
Use server-level DDoS protection
Some web providers provide DDoS mitigation solutions at the server level. As not all web hosting companies offer this option, you should check with your web host. Some businesses provide it for free, while others offer it as a paid add-on. It depends on the hosting provider and package.
Bullet-proof your network hardware configurations
You can avoid a DDoS attack by implementing a few straightforward hardware configuration modifications.
For instance, your firewall or router can be configured to drop inbound ICMP packets or prevent DNS replies from outside your network (by blocking UDP port 53). This will assist in preventing some DNS and ping-based volumetric assaults.
Migrate to a hybrid or cloud-based solution
When you migrate to a hybrid or cloud-based service, you will likely have access to a limitless amount of bandwidth.
Numerous websites that are impacted by DDoS operate with restricted resources. Migrating to a cloud-based solution can assist in ensuring your safety.
Plan for DDoS attacks
Planning for a cyberattack in advance helps you to respond rapidly before they really start destroying your website.
A comprehensive cyber security strategy comprises a list of co-workers who will cope with the assault. It also describes how the system would prioritize its resources to maintain the majority of applications and services up, which might prevent your organization from collapsing.
You can also plan how to contact the Internet Service Provider that is facilitating the assault since they may be able to halt it completely.
