DoS Prevention

Tags:
Categories:

DDoS Prevention

DDoS Definition

Two types of DoS attacks:

  • Cause service crashes
  • Cause network congestion

Attack Types

Attack TypeAttack MethodResponse Method
Distributed DoSMultiple machines with independent IPs attack simultaneously1. Degrade service 2. Blacklist 3. Shut down network devices
Yo-yo attackAttack services with auto-scaling capabilities during resource reduction intervalsBlacklist
Application layer attacksTarget specific functions or features, LAND attacks belong to this typeBlacklist
LANSThis attack method uses specially crafted TCP SYN packets (typically used to open new connections), causing the target machine to initiate empty connections where both source and destination addresses are its own IP, continuously self-responding until system resources are exhausted and it crashes. This attack method differs from SYN flood attacks.Blacklist
Advanced persistent DoSAnti-reconnaissance/targeted/evasion of countermeasures/long-term attacks/large computing power/multi-threaded attacksDegrade service
HTTP slow POST DoS attackCreate legitimate connections then send large amounts of data at extremely slow speeds, causing server resource exhaustionDegrade service
Challenge Collapsar (CC) attackFrequently send standard legitimate requests that consume more resources, such as search engines consuming large amounts of memoryDegrade service, content identification
ICMP flood Internet Control Message Protocol (ICMP) floodLarge amounts of ping/error ping packets /Ping of death(malformed ping packet)Degrade service
Permanent denial-of-service attacksAttack hardwareContent identification
Reflected attackSend requests to third parties, forging addresses to direct responses to the actual victimddos category
AmplificationUse some services as reflectors to amplify trafficddos category
Mirai botnetUtilize compromised IoT devicesddos category
SACK PanicManipulate maximum segment size and selective acknowledgment, causing retransmissionsContent identification
Shrew attackExploit weaknesses in TCP retransmission timeout mechanism, using brief synchronous traffic bursts to interrupt TCP connections on the same linkTimeout discard
Slow Read attackSimilar to slow post, send legitimate requests but read very slowly to exhaust connection pool, achieved by advertising a very small number for TCP Receive Window sizeTimeout disconnect, degrade service, blacklist
SYN floodSend large amounts of TCP/SYN packets, causing server to generate half-open connectionsTimeout mechanism
Teardrop attacksSend corrupted IP fragments with overlapping, oversized payloads to target machinesContent identification
TTL expiration attackWhen packets are discarded due to TTL expiration, router CPU must generate and send ICMP timeout responses. Generating many such responses overloads the router’s CPUDiscard traffic
UPnP attackBased on DNS amplification technology, but the attack mechanism is a UPnP router that forwards requests from one external source to another, ignoring UPnP behavioral rulesDegrade service
SSDP reflection attackMany devices, including some residential routers, have vulnerabilities in UPnP software that attackers can exploit to get responses to their chosen target addresses from port 1900.Degrade service, block port
ARP spoofingAssociate MAC address with IP address of another computer or gateway (such as router), causing traffic originally intended for the original real IP to be rerouted to the attacker, resulting in denial of service.ddos category

Prevention Measures

  1. Identify attack traffic
    • Disrupt service
      • Identify traffic content
    • Congest service
      • Record access times
  2. Process attack traffic
    • Discard attack traffic
    • Block attack IPs
      • Limited number of IPv4 IPs, easy to create blacklists
      • Large number of IPv6 addresses, difficult to create blacklists. Can use IPv6 address ranges, but risk of incorrect blocking
    • Control access frequency

Open Source Tools

Attack Tools

Defense Tools

Traffic Monitoring