Understanding DDoS Attack Types
Distributed Denial of Service attacks overwhelm targets with traffic or exploit protocol weaknesses. Modern DDoS attacks combine multiple vectors simultaneously, making defense complex.
Attack Categories
Volumetric Attacks
Flood bandwidth capacity:- UDP flood
- DNS amplification (50-70x amplification)
- NTP amplification (556x amplification)
- Memcached amplification (50,000x amplification)
Protocol Attacks
Exhaust server resources:- SYN flood (fills connection table)
- Ping of Death
- Smurf attack
- Fragmented packet attacks
Application-Layer Attacks
Target specific application functionality:- HTTP flood (GET/POST)
- Slowloris (keeps connections open)
- RUDY (slow POST body)
- DNS query flood
Defense Architecture
Edge Protection (CDN/Anycast)
- Distribute traffic across global points of presence
- Absorb volumetric attacks at the edge
- Anycast routing directs traffic to nearest scrubbing center
Scrubbing Centers
- Deep packet inspection to filter malicious traffic
- Behavioral analysis for application-layer attacks
- Clean traffic forwarded to origin
Rate Limiting
# Progressive rate limiting
Tier 1: 1000 req/min per IP (alert)
Tier 2: 2000 req/min per IP (challenge)
Tier 3: 5000 req/min per IP (block)
Challenge-Response
- JavaScript challenges for browser verification
- CAPTCHA for suspicious traffic
- Cookie validation for bot detection
Incident Response
- Detect: Monitor traffic baselines and alert on anomalies
- Classify: Determine attack vector(s)
- Mitigate: Activate appropriate countermeasures
- Communicate: Notify stakeholders and users
- Analyze: Post-attack forensics and improvement
Where SuperClue Fits
SuperClue does not assess DDoS resilience. Its DAST scanner checks the web layer, including whether your APIs enforce rate limits, which helps against application-layer floods.