DDoS Attacks Over the Last Three Years: Emerging Trends and Defensive Approaches

The data shows DDoS attacks have become a major threat which can cause service disruptions for organizations. The number of DDoS attacks together with their frequency and bandwidth have shown continuous growth according to the Spamhaus attack example. The Spamhaus attack from 2013 became the biggest DDoS attack recorded at that time. The attack size remained unknown to the organization, but it successfully overwhelmed their connection and disabled their website for an extended duration. The attack used DNS reflection techniques to perform a layer 3 attack which became known as the largest DDoS attack in 2013. The DNS reflection attack method has become the leading cause of layer 3 DDoS attacks which now reach beyond 100 Gbps in size. The attack demonstrated that DNS reflection attacks depend on open DNS resolvers for their operation and the attack size will increase until organizations start implementing effective solutions to block these attacks. The attackers used open DNS resolvers to send DNS zone file requests for ripe.net during the Spamhaus attack. The open resolvers provided DNS zone file responses which produced 75 Gbps of attack traffic while each response contained 3,000 bytes that resulted in a 100x amplification effect. The attackers used 30,000 different DNS resolvers to execute their attack. The average amount of traffic each open DNS resolver transmitted during the attack reached 2.5 Mbps which remained below the detection threshold of most DNS resolvers.