Classification of DDoS attacks

Classification of DDoS attacks

All DDoS attacks can be divided into two categories:

Bandwidth attack – attacker tries to flood communication channels, allocated bandwidth and hardware with a large number of packets.
Attack on applications – attacker exploits the behavior of TCP, HTTP, and other protocols, as well as the behavior of services and applications to overload computing resources. It prevents the resource from processing legitimate transactions and requests.

The System distinguishes the following types of attacks:

Types of DDoS attacks

Type	Description
TCP short packet	TCP based attack with short packets. It is aimed at channel overflow or exhaustion of TCP stack resources of the Customer.
TCP data	TCP based attack with long packets, usually without establishing a connection. It is aimed at communication channel overflow.
UDP misuse	UDP based attack, usually with large packets. It is aimed at communication channel overflow.
ICMP misuse	ICMP based attack, usually with large packets. It is aimed at communication channel overflow.
HTTP misuse	HTTP based attack. It is aimed at overloading the application processing HTTP requests or the entire server.
TCP connect	Establishing multiple connections without transmission or with slow data transmission in order to exhaust the Customer's TCP stack resources.
Mixed	Mixed attack that has characteristics of different types of attacks.
TLS misuse	HTTPS based attack. It is aimed at overloading HTTPS service with a large number of requests.
Fragmented	Attack with fragmented IP packets. It is aimed at overflowing the channel to a resource and/or exhausting the router's resources.
Slow	Attack at a very slow speed. It is aimed at overflowing the channel to a resource and/or exhausting the router's resources.
Protocol misuse	Attack with large number of malformed or non-standard HTTP requests. It is aimed at overloading the application processing HTTP requests or the entire server.
Scanning	Automated port scanning for open services. This activity does not disrupt operations of the Protected Resource but can be a signal of preparation for a potential attack.