DDOS attacks less frequent last year, more dangerous

The total number of distributed denial of service attacks declined steadily last year, from more than 450,000 attacks in the first quarter to fewer than 150,000 in the fourth quarter -- but the size and complexity of the average attack both increased, according to a new report from Black Lotus Communications.

San Francisco-based Black Lotus, a DDOS mitigation firm, saw a total of 1.14 million different attacks last year, with an "alarming" surge in the last quarter of the year.

The average bit volume of each attack -- the number of packets, multiplied by the size of each packet -- increased 3.4 times compared to the third quarter of the year.

In addition, it was the first time that Black Lotus saw average attack size pass 10 gigabits per second, reaching an average of 12.1 Gbps in the fourth quarter, up from just 2.7 Gbps at the start of the year.

This isn't bad news for Black Lotus, which is in the business of protecting organizations from the largest attacks. But it is bad news for enterprises doing their own DDOS mitigation.

"If people are trying to defend their own network using an on-premise device, they typically don't have the capacity to exceed 20 gigabits," said Frank Ip, the company's VP of marketing and business development.

In other bad news, the complexity of attacks has already increased.

"There is a continuous trend of people combining different attacks together, in hybrid attacks," Ip said.

"We're also seeing more application-layer attacks," he added. "Even though those are smaller in size, they are not smaller in terms of effect or damage to the targeted victim."

While network attacks try to use up all the network bandwidth, application attacks target just one application's resources, he explained.

"These are much easier to over run," he said.

In fact, he said, the increased sophistication of the attacks may explain, in part, why there are fewer of them.

"They're being more efficient," he said. "They don't have to lodge as many attacks to accomplish what they have to accomplish."

There was also some good news last year, he added.

Attacks that used compromise servers to magnify the size of the attack are almost completely gone, he said.

"All the operators and companies that ran DNS and servers have patched up all the loopholes," he said. "There are no more vulnerable servers available to generate those large volumes."

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Have an opinion on security? Want to have your articles published on CSO? Please contact CSO Content Manager for our guidelines.

Tags network securityLotus

More about

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Maria Korolov

Latest Videos

More videos

Blog Posts