Understanding DDoS = Containing DDoS
Distributed denial of service (DDoS), like many other cybersecurity buzz words, is a high-level common description of multiple attacks, which hide many variations underneath. Most cyber-attacks are used for data breaching, either to steal or to damage content (data) such as credit card data theft or encryption for ransomware. DDoS, on the other hand, can’t be used for such objectives because it’s a more primitive method of attack. Its main purpose is to slow down or entirely cut out a specific service.
Key Takeaways
- Unlike most cyberattacks that target data theft or encryption, DDoS is a service disruption tool — its sole purpose is to slow down or entirely cut off access to a specific service, not to breach data directly
- The ideal DDoS mitigation strategy is to eliminate attack traffic as close to its source as possible, but this is rarely achievable since attacks originate from multiple locations, use spoofed IPs, and traverse networks outside the victim's control
- Scrubbing centers excel at volumetric Layer 3-4 attacks and can protect both the target service and its upstream infrastructure, but their asymmetric traffic view limits detection accuracy for more complex attacks
- On-premises solutions provide symmetric traffic visibility — seeing both inbound and outbound flows — enabling stateful and application-layer (Layer 7) protection, but cannot absorb attacks that exceed the capacity of the upstream link itself
- Cloud DDoS protection distributes attack traffic across multiple global data centers, naturally fragmenting large volumetric attacks into manageable portions at each site, making it particularly effective against geographically distributed attack sources
As a common DDoS use case example, imagine two gamers playing an online game using a shared gaming server. While one of the two players is winning, the other sends a UDP flood, multiple UDP packets generated at high volume to a specific destination, towards the gaming server, resulting in a server slow-down or interrupting the ability to play.
DDoS attacks are commonly used against gaming, gambling, government and military public sites, universities, financial institutions and large retail sites. For each situation, the reason for the attack might be different, as an example:
- In gambling or gaming, a DDoS attack can affect the user experience, which could lead to a competitive company to gain new customers.
- With government online services, an enemy country can initiate a DDoS attack for either propaganda reasons or for denying essential services to citizens.
There are several approaches to protecting against DDoS attacks. The most common are on-premises, scrubbing centers and cloud-based. The ultimate goal is to eliminate an attack as near as possible to the originating location, keeping in mind that the side effect of a DDoS attack includes the slowing down of intermediate networks (which carries over to the victim site). However, in most cases it is nearly impossible to deploy DDoS protection near the source given the following:
- An attack can be generated from multiple locations
- Little control of remote networks that may be managed by a random service provider
- Spoofed attacks that are hiding the attack origin
Analyzing the different DDoS protection approaches, it is easy to identify the pros and cons of each. Therefore, it is recommended to understand both the type of protected service as well as the types of attacks that are expected to be used against that specific service. Below is a short description of the three approaches, including the pros and cons:
Figure 1: Attack propagation diagram.
DDoS scrubbing centers are a common solution for DDoS protection offered by many service providers for enterprises. This solution excels in mitigating high-volume attacks (volumetric DDoS) and can stop attacks before reaching the customer data center. This results in protection of both the service and the infrastructures. While scrubbing is provided as near as possible to the source, it is based on asymmetric protection, meaning that it can only see the traffic arriving from the client to the service, which limits the traffic visibility and might result in less accurate mitigation filters. This approach is optimal for mitigating network transport DDoS attacks, known as Layer 3 to Layer 4 DDoS attacks such as SYN flood, UDP amplification etc.
An on-premises DDoS protection solution is installed at the last mile, commonly in symmetric mode, meaning it can see both directions of the traffic, which enables additional capabilities such as stateful protection. This allows the DDoS protection solution to mitigate attacks all the way up to the application level, known as Layer 7. In most cases, it is not recommended to use the on-premises approach on its own as major DDoS attacks might overflow the incoming links from the service provider to the data center. Therefore, it is commonly used as a last resort for attacks that managed to bypass the service provider protection.
Cloud DDoS protection service is last. Now, first, note that cloud offerings usually span beyond just a DDoS protection solution. They are often a complete cyber protection and content delivery service, mainly focusing on web services protection and delivery. Most of these solutions are operating as a distributed service based on multiple cloud data centers across the globe, which can become very useful for attack mitigation. Imagine an attack that has been generated from multiple locations, with a cloud service, the attack will be spread across multiple cloud sites. Each will manage a small portion of the attack, which might even not even qualify it as a DDoS attack at all anymore.
It is important to note that in addition to the three approaches above, most service providers are deploying an additional DDoS mitigation solution to protect their own networks from DDoS attacks, as this network is one of the most precious assets they own.
The conclusion here is that for each type of service or for each customer type, a DDoS mitigation solution needs to be adjusted to the specific conditions.
A10 Networks is a leader in DDoS protection solutions, based on its unique DDoS mitigation approach with machine learning, ultra-low latency and mitigation auto-scaling. A10 Defend is used by many tier-1 service providers as well as gaming, finance, and government services.
More information on the solutions offered by A10 Networks can be found here.
FAQs
Asymmetric protection, typical of scrubbing centers, only sees traffic flowing in one direction — from client to server. Symmetric protection, typical of on-premises solutions, sees both inbound and outbound traffic. Symmetric visibility enables stateful inspection, which tracks the state of connections and is necessary for accurate detection of application-layer attacks that require bidirectional context to identify.
A UDP flood sends large volumes of User Datagram Protocol packets to random ports on a target server, forcing it to repeatedly check for applications listening at those ports and reply with ICMP “destination unreachable” messages. Since UDP is connectionless and requires no handshake, it is easy to generate at scale and difficult to distinguish from legitimate UDP traffic without deep inspection.
Service provider networks are high-value targets in their own right. If their core infrastructure is overwhelmed, all customers on that network are affected simultaneously. Their own DDoS mitigation protects the shared infrastructure that carries customer traffic, preventing a single large attack from cascading into service degradation for the entire provider network.
In a standard UDP flood, the attacker generates all the traffic directly. In a UDP amplification attack the attacker spoofs the victim’s IP address and sends small requests to publicly accessible UDP services — such as DNS or NTP — which reply with much larger responses directed to the victim. This multiplies the attack volume without requiring proportional attacker resources, making it far more efficient and harder to trace back to the source.
Traditional rule-based mitigation relies on static thresholds and signatures that attackers can probe and evade. Machine learning continuously analyzes traffic baselines and adapts detection models in real time, identifying anomalous patterns that fall below static thresholds, reducing false positives on legitimate traffic, and responding to novel attack variations that no predefined rule would catch.