Cloudbric ADDoS

The trend of DDoS Attacks:
Layer 3,4 attacks evolve into elaborate layer 7 attacks

Transport & Network Layer
(Layer 3,4) Attacks

Application layer
(Layer 7) attack

DDoS attacks are growing more sophisticated and complex every year, yet existing measures are not keeping up to pace. Since L7(Application Layer) Attacks are more elaborate and difficult to block than L3,4 attacks, The number of DDoS attacks on L7 has been significantly increasing. However, most CDN companies that provide DDoS mitigation services cannot detect & block application-layer attacks well.

Layer 3,4 attacks rely on massive high volumes of data to slow or crash web servers down. The characteristic of layer 3,4 attacks is that it does not require TCP. TCP is usually used in conjunction with IP to maintain the connection between the sender and the target. When the target server is under the stack, large amounts of junk data usually overwhelm the target’s resources making the target crash. The most common DDoS attacks on Layer 3,4 are ICMP, SYN, UDP floods, and so on.

The application layer refers to the human-computer interaction layer where applications can access network services. Such an attack is usually done through an HTTP flood: similar to refreshing a web browser repeatedly on many devices at once. Many requests flood the target’s server, resulting in denial-of-service. Since the malicious traffic is hard to differentiate from legitimate traffic, layer 7 attacks are hard to defend against.