A distributed denial-of-service (DDoS) attack turns multiple computers into a single attack platform. Malicious programs connect to these computers remotely and launch attacks against one or more targets. The attacks consume the processing capacity or network bandwidth of the target servers, so the servers cannot provide services as expected.
How DDoS attacks work
At its core, a DDoS attack is a coordinated attack that uses a botnet:
Attackers gain control of many internet-connected devices by illegal means and build a large botnet.
During an attack, the attacker issues commands from a control server. Every zombie host in the botnet then simultaneously sends a concentrated, massive volume of invalid requests or traffic to one specific target, such as a website or a server.
This sudden traffic surge quickly exhausts the system resources or network bandwidth of the target server, causing the service to respond slowly or fail completely. The server can then no longer process legitimate requests from normal users, which is the intended denial of service.
DDoS attacks and their impact
Major economic and brand losses: An attack can interrupt your service and block user access, which directly causes economic losses such as lost orders and lost customers. It also severely damages your brand reputation.
NoteExample: When an e-commerce platform is hit by a DDoS attack, its website becomes inaccessible or briefly shuts down, so legitimate users cannot place orders.
Data breach risk: A DDoS attack can serve as a tactical diversion. While it creates network chaos, attackers may seize the opportunity to break into your systems and steal sensitive core data.
Malicious business competition: Attackers can use a DDoS attack as an unfair competitive tactic, paralyzing a rival's service to damage its business, seize market share, and disrupt the industry ecosystem.
NoteExample: When a game service is hit by a DDoS attack, its player count drops sharply and the service goes completely offline within a few days.
How do I know whether my service is under a DDoS attack?
To determine whether your service is under a DDoS attack, look for the following abnormal symptoms:
Rely on the asset status shown on the Assets page of the Traffic Security console to determine whether an asset is under attack. For instructions on how to view the asset status, see View the Assets page.
Degraded service quality: Access to your service lags or responds slowly, or many users disconnect at the same time.
Abnormal server resource usage: CPU or memory usage spikes within a short period.
Surging network traffic: Outbound or inbound traffic shows abnormal peaks.
Flood of unknown requests: Your website or application receives many requests from unknown sources.
Remote management issues: You cannot log on to the server, or it responds extremely slowly.
What DDoS protection does Alibaba Cloud provide?
To select the right Anti-DDoS product, see the selection guide.
Anti-DDoS Basic (Free)
Anti-DDoS Basic provides 500 Mbps to 5 Gbps of DDoS mitigation capacity for the Alibaba Cloud products that you purchase (ECS, Server Load Balancer, EIP (including EIPs bound to NAT gateways), , Global Accelerator, and Web Application Firewall). For details, see the documentation of each of these cloud products.
Anti-DDoS Native
Anti-DDoS Native is integrated in transparent mode and protects resources deployed on Alibaba Cloud. For details, see What is Anti-DDoS Native?.
Anti-DDoS Proxy
Anti-DDoS Proxy is integrated in proxy access mode and protects ports and domain names. It can also protect hosts that are not deployed on Alibaba Cloud. For details, see What is Anti-DDoS Proxy?.
Common types of DDoS attacks
DDoS attack category | Attack subtype | Description |
Malformed packets | Malformed packets primarily include Frag Flood, Smurf, Stream Flood, Land Flood, malformed IP packets, malformed TCP packets, and malformed UDP packets. | A malformed packet attack sends defective IP packets to a target system, causing the system to crash when it processes the packets and resulting in a denial of service. |
Transport layer DDoS attacks | Transport layer DDoS attacks primarily include SYN Flood, ACK Flood, UDP Flood, ICMP Flood, and RST Flood. | For example, a SYN Flood attack exploits the TCP three-way handshake. When the server receives a SYN request, it must use a listen queue to hold the connection for a period of time. The attacker keeps sending SYN requests without responding to the SYN+ACK packets, and this consumes the server's resources. When the listen queue is full, the server can no longer respond to requests from normal users, which achieves a denial of service. |
DNS DDoS attacks | DNS DDoS attacks primarily include DNS Request Flood, DNS Response Flood, DNS Query Flood from spoofed and real sources, authoritative server attacks, and local server attacks. | For example, a DNS Query Flood attack sends genuine query requests, which in essence are normal service behavior. However, when many zombie hosts simultaneously send massive volumes of domain name query requests, the server can no longer respond to normal queries. This results in a denial of service. |
Connection-based DDoS attacks | Connection-based DDoS attacks are primarily slow attacks, such as TCP slow connection attacks, connection exhaustion attacks, LOIC, HOIC, Slowloris, Pyloris, and XOIC. | For example, a Slowloris attack targets the concurrency limit of a web server. After the number of concurrent connections reaches this limit, the web service can no longer accept new requests. When the web service receives a new HTTP request, it establishes a new connection to process the request and closes the connection after processing is complete. If a connection stays open, the web service must establish another connection to process a new HTTP request. When all connections stay open, the web service cannot process any new requests. A Slowloris attack exploits HTTP protocol features. An HTTP request uses |
Web application layer DDoS attacks | Web application layer attacks primarily include HTTP GET Flood, HTTP POST Flood, and CC attacks. | Application layer attacks usually emulate user requests exactly. Like traffic from search engines and crawlers, these attacks have no strict boundary with normal business traffic and are difficult to distinguish. Some transactions and pages in a web service are resource-intensive. For example, consider pagination and sharding in a web application. If the parameters that control a page are too large, frequent page turning consumes a large amount of web service resources. Especially under high concurrency and frequent calls, transactions like these became the targets of early CC attacks. Because most attacks today are hybrid, frequent operations that simulate user behavior can all be considered CC attacks. For example, website access from ticket-grabbing software is, to some extent, a CC attack. CC attacks target the backend services of a web application. In addition to causing a denial of service, they directly affect the features and performance of the web application, including web response time, database services, and disk read and write operations.= |