DDoS mitigation

DDoS mitigation is a set of techniques for resisting distributed denial-of-service (DDoS) attacks on networks attached to the Internet by protecting the target and relay networks.[1] This is done by passing network traffic addressed to the attacked network through high-capacity networks with "traffic scrubbing" filters.[2] DDoS mitigation requires correctly identifying incoming traffic to separate human traffic from human-like bots and hijacked web browsers. The process is done by comparing signatures and examining different attributes of the traffic, including IP addresses, cookie variations, HTTP headers, and Javascript footprints.

Manual DDoS mitigation is no longer recommended due to DDoS attackers being able to circumvent DDoS mitigation software that is activated manually.[3] Best practices for DDoS mitigation include having both anti-DDoS technology and anti-DDoS emergency response services.[3] DDoS mitigation is also available through cloud-based providers.[2]

Methods of attack

DDoS attacks are executed against websites and networks of selected victims. A number of vendors are offering "DDoS resistant" hosting services, mostly based on techniques similar to content distribution networks. Distribution avoids single point of congestion and prevents the DDoS attack from concentrating on a single target.

One technique of DDoS attacks is to use misconfigured third-party networks that allow amplification[4] of spoofed UDP packets. Proper configuration of network equipment, enabling ingress filtering and egress filtering, as documented in BCP 38[5] and RFC 6959,[6] prevents amplification and spoofing, thus reducing the number of relay networks available to attackers.

See also

References

  1. ↑ Gaffan, Marc (20 December 2012). "The 5 Essentials of DDoS Mitigation". Wired.com. Retrieved 25 March 2014.
  2. 1 2 Paganini, Pierluigi (10 June 2013). "Choosing a DDoS mitigation solution…the cloud based approach". Cyber Defense Magazine. Retrieved 25 March 2014.
  3. 1 2 Tan, Francis (2 May 2011). "DDoS attacks: Prevention and Mitigation". The Next Web. Retrieved 25 March 2014.
  4. ↑ Christian Rossow. "Amplification DDoS".
  5. ↑ "Network Ingress Filtering: IP Source Address Spoofing". IETF. 2000.
  6. ↑ "Source Address Validation Improvement (SAVI) Threat Scope". IETF. 2013.
This article is issued from Wikipedia - version of the Wednesday, January 27, 2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.