Question

DDoS This is something that is far too prevalent, creates many issues in a network, and can ultimately cause a massive loss of income, all without actually harming the server. I would like you to do the following:

1,Research what DDoS is and how it works
2,Find 3 recent attacks and explain what happened
3,Come up with a solution for how to prevent each of those three attacks.

Answer 1

What is DDoS and how it works.

1. DDoS stands for "Distributed Denial of Service"

2. It is a kind of network attack where its main target is the comprised system(contains many), its an trojan infection.

3. In this distributed attack the victims will get attacked from all the end , then the comprised systems will maliciously used by the hackers.

The core part of this attack is the victims system will start getting flood of traffic, which we hard to distinguish the legitimate traffic and infected one. Since it was attack over collection of comprised system, it is not possible to block a singe Ip address to stop this attack, because the infection will planted across many points in the system.

Three different attacks and how to overcome each attack:

1. Traffic Attacks : Malware exploitation by sending a huge traffic (TCP, UDP) to the system to victims systems.

Overcome steps:

~ Monitor the traffic keenly, the earlier you got to know about the attack easy to shield it.

~ Familiarize yourself about the average traffic of legitimate users, using proper data analysis. Usually the DDoS attack start as sharp spike in traffic, have glimpse on that kind of information.

2. Bandwidth Attacks : It will overload the target systems with load of junk data, which will eventually cause loss of network bandwidth, leads to denial of service.

Overcome steps:

~ To prevent this bandwidth attack it is good to have more bandwidth than the actual need, which will give enough time to counter act against the attack, if any happens.

~ limit the data rate at the router for incoming traffic to a reasonable extent, which will prevent the server from getting overwhelmed.

~ Add filters at the obvious point of attack, based on previous updates.

3. Application Attacks: The application layer of the network will be compromised here, which will delete the core resource there and will lead the system to unserviceable.