CARNEGIE MELLON UNIVERSITY : Distributed Denial-of-Service (DDoS) (Amelia Rose Smith) I. Introduction In the digital era, distributed denial-of-service (DDoS) assaults are a frequent and rising danger to enterprises. An online assault known as a DDoS tries to block legitimate users from accessing a website or online service by flooding it with traffic from various sources. Attackers who carry out these assaults deliver information to the intended website or service via a botnet, a collection of infected computers and other devices. Organizations that rely significantly on their online presence, with the value government agencies, financial institutions, and e-commerce websites, are vulnerable to DDoS assaults. They may lead to sizeable monetary losses, harm to their reputations, and a decline in customer confidence.DDoS assaults are also growing more complex and challenging to detect, which makes them a constant threat to enterprises. The goal of this study is to offer a thorough overview of DDoS assaults, including their methodology, kinds, and potential effects on businesses. The article will also look at several mitigation strategies that businesses may use to defend themselves against DDoS assaults, such as security software, server setup, and DDoS protection services. Organizations may better secure their online presence and limit the potential harm caused by these assaults by knowing the kinds of DDoS attacks and the procedures that can be taken to mitigate them. DDoS assaults have been floating around for a while, but over time they have developed, become more complicated, and become more challenging to fight against. The majority of DDoS assaults in the past were conducted utilizing a single source, however today's attackers may conduct attacks utilizing a network of hundreds or even millions of hacked machines. Computers, servers, mobile devices, and Internet of Things (IoT) gadgets like smart thermostats or security cameras are just a few examples of the gadgets that may be used in this situation. Finding the attack's source is one of the most difficult aspects of protecting against DDoS assaults. Attackers can conceal their identities in a number of ways, including by faking IP addresses or utilizing proxy servers.DDoS assaults can also originate from anywhere in the globe, making it challenging to find and prosecute the offenders. The potential of DDoS assaults keeps increasing as businesses depend more and more on their online presence.However, organizations can lessen their risk of becoming a target of these attacks by putting in place appropriate security measures and exercising caution. In-depth examination of DDoS assaults, including their effects on companies, the tactics employed by attackers, and the precautions that organizations may take to protect against them, will be provided in this article. DDoS assaults pose a major risk to businesses of all sizes and shapes. A successful assault can have a considerable effect, causing anything from short-term interruptions to long-term harm to an organization's money and image. As an illustration, in 2016 the Dyn provider of internet infrastructure was taken offline by a DDoS assault that was launched using the Mirai botnet, resulting in significant internet disruptions throughout the United States. Attackers often infect a large number of targets with malware to launch a DDoS assault and build a botnet. Once the botnet has been established, the attackers can direct the infected devices to flood the intended website or service with traffic, overloading its servers and blocking access to legitimate users. ICMP packets, HTTP requests, and other kinds of network traffic are all examples of this onslaught of traffic. DDoS assaults come in a variety of forms, including volumetric, protocol, and application layer attacks. The most frequent sort of assault is a volumetric attack, which involves flooding the target's network with traffic. Attacks on the application layer target particular programs or services, such as web servers, whereas attacks on the protocol layer focus on flaws in network protocols. DDoS assaults pose a serious danger to enterprises and can have a negative effect. Organizations can better equip themselves to fight against DDoS assaults by knowing the nature of these attacks and the techniques employed by attackers. By putting in place appropriate security measures such network segmentation, firewalls, and intrusion detection systems, the probability of a successful DDoS assault may be significantly reduced. II. Types of DDoS Attacks Attackers can employ a variety of DDoS tactics to overwhelm a target's servers and prevent authorized users from accessing them. Based on the technique employed to create traffic or the precise target of the assault, these attacks may be divided into several categories. Several of the most typical DDoS attack types are listed below: a) Volumetric attacks: These bombard the network of the target with a ton of traffic, sapping it of all its resources and bandwidth. The UDP flood assault, which bombards the target with lots of User Datagram Protocol (UDP) packets, is the most typical type of volumetric attack. Another type of volumetric assault is DNS amplification, which uses weak Domain Name System (DNS) servers to increase the amount of traffic that is transmitted to the target. b) Attacks against protocols, such as TCP/IP or BGP, aim to exploit flaws in network protocols, causing them to malfunction and obstruct interaction among the target and its users. The SYN flood attack is a typical protocol attack that bombards the victim with many SYN packets, using up its resources and blocking access to genuine users. c) Assaults against the application layer, sometimes referred to as layer 7 assaults, focus on certain applications or services, such as web servers, by flooding them with requests. Due to their ability to replicate real traffic and make it impossible to identify them from regular user activity, such assaults can be challenging to protect against. HTTP flood attacks and Slowloris attacks are two types of application layer assaults. d) Attacks that employ reflection amplification to amplify the quantity of traffic supplied to the target are known as amplification attacks. The attacker makes an inquiry to a service that is susceptible using the victim's IP address as a fake, and the server reacts by sending the victim significantly more traffic.The DNS amplification attack is a typical type of amplification attack that makes use of weak DNS servers to increase the amount of information sent to the target. e) IoT botnet assaults: These attacks generate a botnet that may be used to launch DDoS attacks using susceptible Internet of Things (IoT) devices, such as cameras, routers, and smart TVs. Through well-known flaws or weak default passwords, attackers can gain access to these devices and use them to flood the target's network with traffic. f) Attacks on application-layer protocols: These attacks target certain application-layer protocols, including HTTP, SMTP, or SIP, by taking advantage of flaws in the implementation or the protocol itself. These attacks include HTTP GET/POST floods, in which the attacker bombards the target with numerous HTTP GET or POST requests, and SIP INVITE floods, in which the attacker bombards the victim with numerous Session Initiation Protocol (SIP) INVITE requests. g) Attacks based on SSL: These attacks take use of flaws in the SSL/TLS protocol to flood the target's servers with encrypted traffic, thereby rendering it impossible for them to process genuine data. Since more and more websites and applications utilize SSL/TLS to protect their communication, these attacks are becoming more widespread. SSL renegotiation attacks and SSL/TLS floods are two examples of SSL-based attacks. In conclusion, attackers can launch DDoS assaults using a variety of strategies, each of which has advantages and disadvantages. Organizations may better plan and take precautions against attacks by having a better understanding of the various attack types. Adequate security measures, including traffic filtering and network monitoring, can reduce the likelihood of a successful DDoS assault. It's crucial to remember that different DDoS attack varieties may be combined to produce more complex and potent attacks and are not mutually exclusive. An attacker may, for instance, undertake an application-layer assault to overwhelm the target's web server while also conducting a volumetric attack to eat up the target's bandwidth. In order to reduce the chance of a successful DDoS assault, companies should be ready to fight against a variety of threats and establish a layered defensive plan. DDoS assaults pose a serious danger to enterprises and can result in a variety of issues, such as downtime, decreased performance, and revenue loss. DDoS assaults come in a variety of forms, each with particular traits and strategies for attack. One of the most frequent DDoS attack methods is the volumetric assault, which involves flooding the target's network with a lot of traffic. Botnets, characterized by networks of hacked computers that may be manipulated remotely to launch the assault, are frequently used in these attacks. Attacks against the application layer, commonly referred to as layer 7 attacks, target certain services or applications, such as web servers or DNS servers. These assaults are more complex than volumetric attacks and need for a better comprehension of the infrastructure and vulnerabilities of the target. Another DDoS assault is an amplification attack, which amplifies the amount of data sent to the target by taking use of flaws in particular network protocols including DNS, NTP, and SNMP. This makes it possible for the attacker to create a lot of traffic with little work. Protocol-based attacks, which take advantage of flaws in certain network protocols, and IoT botnet assaults, which leverage weak Internet of Things (IoT) devices to launch the attack, are two more forms of DDoS attacks. In order to deploy efficient mitigation tactics and lower the chance of a successful assault, it is critical for companies to understand the various kinds of DDoS attacks and the techniques used to launch them.