Understanding Denial-of-Service Attacks

Denial-of-Service Attack

Attempt to block service availability for users.

Availability

System's accessibility for authorized users on demand.

Flooding Attack

Overwhelms network capacity with excessive requests.

NIST Definition of DoS

Action impairing authorized use by exhausting resources.

Classic DoS Attack

Simple attack flooding network connection capacity.

Source Address Spoofing

Forged source addresses in attack packets.

SYN Spoofing

Fills connection tables, denying legitimate access.

Flooding Attacks Classification

Based on network protocol used for overload.

DDoS Attack

Distributed attack using multiple compromised systems.

HTTP Flood

Bombards servers with excessive HTTP requests.

Slowloris Attack

Monopolizes server connections with incomplete requests.

Reflection Attack

Spoofed requests to intermediaries flood target.

DNS Amplification Attack

Exploits DNS to amplify response size to target.

DoS Attack Defenses

Strategies to mitigate impacts of DDoS attacks.

Spoofed Source Address Blocking

Prevent spoofed addresses on routers.

TCP Connection Handling

Modified code to defend against SYN spoofing.

Broadcast Amplification Defense

Block IP directed broadcasts to prevent attacks.

Network Monitoring

Detects abnormal traffic patterns during attacks.

Incident Response Plan

Strategy for managing and analyzing attacks.

Rate Limiting Filters

Controls traffic flow to mitigate attack impact.

Packet Capture and Analysis

Identifies attack type and assists in defense.

Contingency Plan

Backup strategies during DoS attack scenarios.

ISP Packet Tracing

Tracks packet flow back to the source.

Legitimate Traffic Volume

High traffic may not always indicate an attack.

System/Application Bug Identification

Correct vulnerabilities exploited during attacks.

Mirrored Servers

Used for high performance and reliability.

Network Handling Code

Manages incoming connections and resources.

Congestion in Networks

Occurs when traffic exceeds network capacity.

Intrusion Detection Systems (IDS)

Monitors network for suspicious activity.