Traffic Flood Attacks: A Complete Understanding of DDoS Attacks and Enterprise Defense Guide

If you open an online mall with a booming business, the flow of passengers will continue every day. Suddenly one day, competitors across the street hire thousands of street gangsters to surround your store door. When they don't buy things, they make a lot of noise at the door and block the passage, so that customers who really want to buy things can't get in at all, and even the shop assistants can't work normally.

In the online world, this kind of bad "blocking the door" behavior is what we often say.

DDoS attack (Distributed Denial of Service, distributed denial of service attack)

.

Whether it is a start-up or a large Internet platform, as long as the service is hung on the public network, DDoS attacks are like the sword of Damocles hanging overhead. Today we will use the most popular language to talk about what is going on with DDoS attacks and how companies should build solid flood dikes in the face of this "traffic flood.

1. what is a DDoS attack? From going it alone to a zombie army"

To understand DDoS, you have to start with its predecessor.

Denial of Service (DoS)

Speaking.

In the early days, hackers often used one of their computers to send massive requests to the target server in an attempt to fill up the server's CPU or bandwidth. This "one-to-one" attack and defense is relatively easy to solve-the server administrator only needs to look at the log, block the attacker's IP address (Blacklist), and the attack is over.

But hackers quickly realized that it was too inefficient to go it alone, so they upgraded their tactics and evolved

DDoS (Distributed Denial of Service)

:

Foster "botnets": Hackers exploit system vulnerabilities or malicious Trojans to take control of thousands of networked devices around the world-including unprotected servers, personal computers, and even Internet of Things (IoT) devices such as smart cameras and routers. These controlled devices are called "zombie machines" or "broilers".

A hacker only needs to press a button on the control side, and tens of thousands of "broilers" will initiate thousands of invalid requests to the target server at the same time.

Completely paralyzed: In the face of a massive influx of fake traffic, the network bandwidth of the target server was instantly filled up, the CPU and memory soared to 100 percent, and the requests of normal users were squeezed out of the door, eventually causing the system to jam and the service to crash.

The most terrible thing about DDoS is "legal disguise"

with

"Distributed": The attack traffic comes from real IP addresses in all corners of the world. It is difficult for you to distinguish in an instant which are normal users and which are hackers' "broilers". Therefore, the traditional single-point protection method is almost completely ineffective.

2. common moves to dismantle DDoS: How did hackers bring down the system?

Although there are many forms of DDoS attacks, from the perspective of network protocol stack, they can be divided into the following three categories:

1. Bandwidth consumption type: plug the "pipe" directly

Full (network layer/transport layer attacks)

Representative moves: UDP Flood, ICMP Flood.

Principle: If your server network card bandwidth is 1Gbps, hackers directly use "broilers" to send 10Gbps or even 100Gbps junk packets to your server. This is like forcibly pouring dozens of times more water into a water pipe than its carrying capacity. The pipe bursts directly and normal data packets cannot enter at all.

2. Protocol vulnerability type: draining the server's connection resources (transport layer/network layer attack)

Representative moves: SYN Flood, ACK Flood.

Principle: Take the most classic SYN Flood as an example, it uses the mechanism of TCP three-way handshake. The hacker sends a large number of SYN connection establishment requests to the server, but deliberately does not respond to the last ACK acknowledgement packet. In order to maintain these "half-open connections", the server retains a large amount of resources and waits until the memory and connection queues are completely exhausted and can no longer handle new normal connections.

3. Application Layer Precision Strike: Dragging down the database with minimal cost (application layer attack/CC attack)

Representative move: HTTP/HTTPS flood (commonly known as CC attack, Challenge Collapsar).

Principle: This is currently the most covert and difficult to prevent attacks. Hackers do not need hundreds of gigabytes of traffic, but only need to control a small number of "broilers" and frequently refresh pages that consume a large amount of server computing resources (for example, complex commodity retrieval, database full table query, verification code generation, etc.).

Consequences: Each request appears to be fully compliant, but the server requires complex database read and write and CPU calculations. Thousands of concurrent requests can instantly drag down the database, causing the front-end page to return 502/504 errors.

Serious consequences of 3. DDoS attacks

For any enterprise that relies on the Internet to carry out its business, DDoS attacks are not only as simple as "the website cannot be opened:

Direct economic losses: Once online shopping malls, game services, and financial trading platforms are interrupted, every minute of suspension means the loss of real money.

Damage to brand reputation: Users who frequently encounter timeouts or crashes when accessing your service will quickly lose trust and turn to competitors.

Extortion and Extortion: The fundamental purpose of many hackers launching DDoS attacks is extortion, requiring companies to pay high cryptocurrency to stop the attack.

Hackers sometimes use DDoS attacks to get the full attention of operations and security teams, secretly exploiting other vulnerabilities to steal core data or implant backdoors.

4. Soldiers: A Comprehensive Solution for Enterprise DDoS Defense

In the face of increasingly complex DDoS attacks, it is no longer enough to increase the hardware configuration of local servers (the hardware cost is much higher than the cost of hackers launching attacks). Modern DDoS defense is about"

Layered filtering, flexible scheduling, active prevention ".

1. Access professional high-security services (cloud anti-D/high-security IP / CDN)

This is currently the most effective and mainstream solution to deal with high-traffic DDoS.

High-security IP/high-security CDN: Resolves the business domain name to the high-security node. All external access traffic will first pass through the high anti-cleaning center.

Traffic cleaning mechanism: The Anti-DDoS system uses high-performance hardware and AI intelligent algorithms to identify and filter malicious garbage traffic such as UDP Flood and SYN Flood in real time, and only forwards clean normal requests back to the origin server (Origin Server).

Near-source cleaning and Anycast (Anycast): Large cloud vendors have deployed multiple large-capacity cleaning centers around the world, using Anycast technology to distribute attack traffic to various nodes around the world for nearby cleaning, avoiding the collapse of single-point bandwidth.

2. Application layer CC attack targeted protection

For CC attacks hidden in normal HTTP requests, you need to combine the application layer firewall (WAF) to accurately combat:

Man-machine identification verification: Introduce mechanisms such as CAPTCHA verification code, sliding verification, and JavaScript challenge (JS Challenge) to intercept automated scripts.

Rate Limiting: Limits the access rate for a single IP address or User-Agent (for example, the same IP address cannot request more than 5 times per second to log on to the interface).

Behavior feature analysis: WAF is used to analyze request header features, Cookies, and access paths to intercept abnormal traffic.

3. Source station architecture protection and concealment

Hide the real IP of the source station: this is the most important thing! If an attacker bypasses CDN or Anti-DDoS Pro and directly attacks the origin IP address, all defenses will be useless. The IP address of the origin station must be strictly confidential to the public network and only allow access to the IP segment of the high-security node.

Auto Scaling: Based on the cloud-native architecture, you can configure an auto scaling group to automatically scale up server instances in the event of a burst of traffic.

4. Establish sound emergency response and daily drills

Real-time monitoring and alarm: Set alarm thresholds for key indicators such as bandwidth utilization, HTTP 5xx error rate, and the number of new connections to ensure that attacks can be detected in the first few minutes.

Formulate emergency plans: clarify the division of responsibilities of the operation and maintenance, security, business and customer service teams when an attack occurs, so as to "switch high defense with one click and quickly downgrade non-core businesses".

5. epilogue

Network security is a long-term dynamic game. The fundamental reason why DDoS attacks have been banned for many years is that the cost of attack and defense is extremely unequal-the threshold for hackers to launch attacks is extremely low, while the cost of defense is relatively expensive.

However, through the "hidden source station access cloud high security/WAF

Standardize the application layer flow limit "this combination of boxing, enterprises can establish a set of flexible and highly available defense system, to minimize the impact of DDoS attacks, to ensure that the business is still stable as a rock in the stormy waves.