DataTerminology.comNEW
Also known as: DDoS
An attack that floods a target with traffic from many sources to exhaust resources and disrupt legitimate access.
DESCRIPTION
A distributed denial-of-service (DDoS) attack leverages numerous compromised hosts or amplifiers to overwhelm network, compute, or application capacity. Common vectors include volumetric floods, protocol exhaustion, and application-layer attacks. Defenses combine anycasted scrubbing networks, CDNs, rate limiting, autoscaling, and upstream filtering. Visibility via telemetry and well-defined SLOs helps detect and mitigate quickly. Preparedness includes runbooks, provider contacts, and layered defenses across network and application tiers.
ALTERNATIVE DEFINITIONS
Cloudflare Learning Center
A DDoS attack is a malicious attempt to disrupt the normal traffic of a targeted server, service or network by overwhelming the target or its surrounding infrastructure with a flood of Internet traffic.
Defines DDoS by disruption of normal traffic using overwhelming floods.
NIST CSRC Glossary
A denial of service technique that uses numerous hosts to perform the attack.
Focuses on the distributed nature: many hosts used simultaneously.
RELATED TERMS
Denial of Service Botnet Amplification Attack Anycast Rate Limiting Web Application Firewall UDP Reflection Autoscaling BGP
COMPETING TERMS
DDoS Mitigation Content Delivery Network
KNOWLEDGE AREAS
Data Security Infrastructure Cloud Observability & Telemetry
TARGET AUDIENCE
Cybersecurity Engineer Security Architect Cloud Architect DevOps Engineer IT Manager IT Auditor
EXTERNAL SOURCES
- Wikipedia - Denial-of-service attack
- Cloudflare - Detailed overview and taxonomy
- CISA - Government guidance on DoS and DDoS
- IETF - BCP 38 ingress filtering guidance
TOP QUESTIONS
What are the main types of DDoS attacks?
Volumetric floods, protocol attacks (e.g., SYN floods), and application-layer attacks (e.g., HTTP floods) target different resources.
Category: Definition
How do CDNs help with DDoS?
CDNs absorb and distribute traffic via large anycast networks, caching content and filtering malicious requests before they hit origin.
Category: Best practices
What is DDoS amplification?
Attackers exploit misconfigured UDP services (e.g., NTP, DNS) to reflect and amplify traffic towards a victim.
Category: Example
Can autoscaling stop DDoS?
Autoscaling helps absorb spikes but isn’t sufficient alone. Use upstream scrubbing and rate limiting to avoid cost and outages.
Category: Misunderstanding
How to detect a DDoS quickly?
Monitor baseline traffic, set SLOs and alerts for anomalies in volume, connection rates, and error codes.
Category: Observability
What preparations reduce DDoS impact?
Have runbooks, provider contacts, BGP communities, and pre-provisioned scrubbing capacity. Test failover paths.
Category: Requirements
Is a WAF enough for DDoS?
WAFs help at L7 but do not solve volumetric or protocol floods. Use layered defenses across L3–L7.
Category: Misunderstanding
Who coordinates DDoS response?
Security, networking, and cloud teams collaborate with upstream providers and CDNs to mitigate and restore service.
Category: Management
What is BCP 38 and why important?
It recommends ingress filtering to block spoofed source addresses, reducing reflection and amplification attacks at scale.
Category: Standards