DDoS (Distributed Denial of Service)
A DDoS attack floods a target from thousands of compromised systems — botnet-driven traffic designed to exhaust bandwidth and knock a site offline.
Defend Against DDoS
Stop bot-driven attacks at the application layer
What is a DDoS Attack?
A distributed denial of service attack makes a service unavailable by overwhelming it from many sources at once. Distributed is the important word: the traffic arrives from thousands of addresses, so blocking any one of them changes nothing.
The goal is availability rather than theft. Nothing is extracted and nothing is encrypted; the service simply stops answering, which for anything transactional is expensive by the minute.
The three layers, and who stops each
| Layer | Example | Who absorbs it |
|---|---|---|
| Volumetric (L3/L4) | UDP reflection, amplification through open resolvers | Your network provider or a scrubbing service. Capacity is the only answer |
| Protocol | SYN flood, fragmented packets | Network stack and edge configuration |
| Application (L7) | Floods of legitimate-looking HTTP requests to expensive endpoints | A traffic layer that can tell requests apart |
Most of what people picture is the first row, and most of what actually takes sites down now is the third. Volumetric attacks are loud and well understood; a few thousand well-chosen requests per second to a search endpoint that runs an unindexed query can achieve the same outcome with a fraction of the bandwidth, and it looks like traffic.
Why layer 7 is the hard one
Every request in an application-layer flood is well formed. It has valid headers, a plausible user-agent, and asks for something your application genuinely offers. There is no signature to match, which is why a WAF is not the control for it.
What distinguishes the flood is the same thing that distinguishes any bot traffic: there is no person behind it. Which is why the same signals apply — behavioural evidence, client coherence, and proof of work, which is especially well suited here because it imposes a cost per request on the attacker rather than asking you to identify them.
Reducing the target
- Know which of your endpoints are expensive. Search, export, report generation, anything unindexed or unbounded. These are what an attacker will aim at, and they are worth caching or bounding before anything else.
- Cache aggressively at the edge, so static content never reaches your origin.
- Rate limit the expensive paths specifically, rather than everything uniformly.
- Keep your origin addresses off public DNS, so an attacker cannot route around your edge.
- Have the provider conversation in advance. Scrubbing capacity arranged during an attack is arranged too late.
Extortion demands, and why paying funds the next one
A proportion of DDoS activity is extortion: a short demonstration burst followed by a payment demand. A non-trivial share of those demands follow no real capability at all, and some follow a burst that your provider absorbed without you noticing.
Do not pay. It funds the capability, marks you as a paying target, and buys no commitment from anyone. Report it, keep the evidence, and talk to your upstream provider — which is also the advice the UK's National Cyber Security Centre gives.