- Types of Application Layer DDoS Attacks
- Types of Application Layer DDoS Attacks
- Signs of an Application Layer DDoS Attack
- Why Are Application Layer Attacks Dangerous
- How to Prevent Application Layer Attacks
Tom Bienkowski
Director, Product Marketing
What is an Application Layer DDoS Attack?
Application layer DDoS attacks are designed to attack the application itself, focusing on specific vulnerabilities or issues, resulting in the application not being able to deliver content to the user. Application layer attacks are designed to attack specific applications, the most common is web servers, but can include any application such SIP voice services and BGP.
Such DDoS attacks are usually low-to-mid volume since they have to conform to the protocol the application is using, which often involves protocol handshakes and protocol/application compliance. This means that these DDoS attacks will primarily be launched using discrete intelligent clients, usually Internet of Things (IoT) devices, and cannot be spoofed. NETSCOUT's Arbor Edge Defense is a powerful tool that lives on the perimeter of your network, providing stout hybrid DDoS protection from several types of attacks, including application layer attacks.
What Are the Different Types of Application Layer DDoS Attack?
When looking at DDoS trends over time, attacks are cyclical in nature. Attackers develop new DDoS attack types and vectors, which are used to launch a new wave of attacks. As defenders become more proficient in stopping these new DDoS attacks, the attackers develop new DDoS attack vectors and the cycle repeats itself.
The proliferation of insecure IoT devices in recent years has been a boon to the DDoS attackers as there are now a nearly unlimited number of intelligent devices which can be used to launch more advanced application layer attacks.
Common application layer attacks might include:
What Are the Signs of an Application Layer DDoS Attack?
Application layer DDoS attacks can be detected using security-focused flow analysis; however, since they are low-volume DDoS attacks, it is necessary to use behavioral analysis or deep packet inspection to uncover them. What is required is the use of IDMSs to detect the specific attack vector used by either employing virtual or physical appliances' visibility into the traffic.
Don’t Fall Victim to Application Layer Attacks
Why Are Application Layer Attacks Dangerous?
Cybercriminals are constantly evolving their toolset and looking for new application layer attack techniques. And because they now have access to millions of vulnerable IoT devices, they can launch complex DDoS attacks at scales never seen before.
What makes application layer DDoS attacks most dangerous is that even when multi-vector attacks contain identifiable patterns, a determined attacker will monitor the results of his attack and modify it to thwart a skilled and determined defender. Because active attackers are known to continually modify payload patterns to avoid simplistic DDoS mitigation, maintaining an ongoing list of known attack patterns quickly becomes impractical due to scale issues and the rate at which this list must be updated. Further, since payload patterns bring a high risk of causing collateral damage, maintaining a long-lived set of payload patterns may be unwise.
How to Prevent Application Layer Attacks
Because DDoS attacks can be complex in nature and a determined attacker will rapidly change the attack vector to avoid mitigation, the IDMS should use a set of methods to analyze and block these kinds of DDoS attacks.
Best practices to defend against constantly evolving types of denial of service attacks include:
- Use flow telemetry analysis supplemented with behavioral analysis to detect abnormalities and attacks. Focus on understanding what is normal. This will simplify the identification of abnormalities.
- Use an IDMS to detect abnormal behavior and application layer attacks that require advanced and active mitigation; and using this approach in conjunction with BGP FlowSpec Offload when and where appropriate.
If implemented successfully, these comprehensive DDoS protection techniques will force the attacker to behave like normal clients, rendering the DDoS attack ineffective and allowing for the use of application-level analysis to detect any abnormal traffic or usage patterns.
Protect Yourself From Application Layer DDoS Attacks
What is an Application Attack?
Application attacks (aka application layer DDoS attacks) are designed to attack specific vulnerabilities or issues within a specific application, resulting in the application not being able to deliver content to the user.
How can NETSCOUT help?
NETSCOUT's Arbor DDoS solution has been protecting the world's largest and most demanding networks from DDoS attacks for more than a decade. We strongly believe that the best way to protect your resources from modern DDoS attacks is through a multi-layer deployment of purpose-built DDoS mitigation solutions.
Only with a tightly integrated, multi-layer defense can you adequately protect your organization from the full spectrum of DDoS attacks.
Arbor SP/Threat Mitigation System
NETSCOUT customers enjoy a considerable competitive advantage by getting both a micro view of their own network, via our products, combined with a macro view of global Internet traffic, via NETSCOUT Cyber Threat Horizon, an interface to our ATLAS threat intelligence and a DDoS Attack Map visualization.
Related Resources
How to Mitigate DDoS Attacks
Learn how NETSCOUT Arbor Sightline with Sentinel can be used to intelligently orchestrate multiple methods of DDoS attack mitigation.
Hybrid DDoS Protection Solutions
As DDoS attacks continue to rise in size, frequency and complexity, organizations need a hybrid DDoS prevention strategy that evolves to match the ever-changing threat landscape.
ATLAS Intelligence Feed (AIF) for Arbor Edge Defense
The ATLAS Intelligence Feed (AIF) empowers users with policies and countermeasures to address attacks as part of an advanced threat or DDoS attack. The information provided enables network and security operations teams to ensure the latest threat protections are available and defending their Enterprise environment. The AIF is a service of the ATLAS Security...