DDoS Attack
A Distributed Denial-of-Service (DDoS) attack is an attempt to overwhelm a server, service, or network with a flood of traffic from many compromised sources at once, making it slow or unavailable to legitimate users.
Definition
A Distributed Denial-of-Service (DDoS) attack is an attempt to overwhelm a server, service, or network with a flood of traffic from many compromised sources at once, making it slow or unavailable to legitimate users.
Overview
Unlike a simple denial-of-service attack launched from a single machine, a DDoS attack is distributed across thousands or millions of hijacked devices — often a botnet of compromised computers, routers, or IoT devices — making it far harder to block by simply denying one IP address. Attackers coordinate these devices to send an overwhelming volume of requests, packets, or connection attempts at a target simultaneously. DDoS attacks generally fall into three categories: volumetric attacks that saturate available bandwidth (e.g., UDP floods, DNS amplification), protocol attacks that exhaust server or network equipment resources (e.g., SYN floods), and application-layer attacks that mimic legitimate traffic to exhaust web server resources (e.g., HTTP floods targeting a login page). Defending against DDoS typically involves traffic scrubbing services, rate limiting, a content delivery network or Web Application Firewall (WAF) to absorb and filter malicious traffic, and network-level redundancy. DDoS protection is a foundational topic in courses like Cloud Security Fundamentals, since cloud providers offer managed mitigation services that scale to absorb multi-gigabit attacks automatically.
Key Concepts
- Uses many distributed, often compromised, source machines instead of a single attacker
- Volumetric, protocol, and application-layer attack categories target different weak points
- Amplification techniques (DNS, NTP) let attackers multiply traffic volume cheaply
- Botnets of hijacked IoT devices are a common attack infrastructure
- Mitigated with traffic scrubbing, rate limiting, and CDN/WAF absorption
- Attacks can target bandwidth, server resources, or application logic
- Modern attacks increasingly combine multiple vectors simultaneously
Use Cases
Frequently Asked Questions
From the Blog
Cybersecurity for Developers: The OWASP Top 10 Explained
The OWASP Top 10 is the industry standard list of critical web application security risks. This guide explains each vulnerability, shows what an attack looks like, and gives concrete code fixes that every developer can implement today.
Read More Cloud & CybersecurityWhat Is CSRF and How to Prevent It
CSRF tricks a logged-in user's browser into sending unwanted requests to a site. Learn how the attack works and how tokens and SameSite cookies stop it.
Read More AI & TechnologyWhat Is Prompt Injection and How to Prevent It
Prompt injection tricks an LLM into ignoring its instructions by hiding malicious commands in user or retrieved text. Learn how the attack works and how to defend against it.
Read More