DDoS attack classification

DDoS（Distributed Denial of Service, Distributed denial of service ） It is to unite multiple computers as an attack platform , By remote connection , Use malicious programs to attack a target , Consume target service performance and bandwidth , As a result, the server cannot provide services normally , Even the core data of the business is stolen , Thus causing huge economic losses .

DDoS Attacks fall into two broad categories ： Transport layer DDoS Attack and application layer DDoS attack .

• Transport layer DDoS attack
  It mainly includes Syn Flood、Ack Flood、UDP Flood、ICMP Flood. With Syn Flood Take attack as an example , It takes advantage of it. TCP The triple handshake mechanism of the agreement , When the server receives a Syn When asked , The server must use a listening queue to save the connection for a certain time . therefore , It keeps sending to the server Syn request , But no response Syn+Ack message , Thus consuming the resources of the server . When the server listening queue is full , The server will not be able to respond to the requests of normal users , Achieve the purpose of denial of service attack .

• application layer DDoS attack
  It mainly includes DNS DDoS Attack and Web application DDoS attack .DNS DDoS Attacks mainly include DNS Request Flood、DNS Response Flood、 False source + True source DNS Query Flood.Web application DDoS Attack mainly refers to HTTP Get Flood、HTTP Post Flood etc. .HTTP Get Flood Usually refers to hackers from Web Find out some transactions and pages with high resource consumption in the service or interface , And keep sending these transactions and pages HTTP Get request , Which leads to Web Application server resources are exhausted , Unable to provide normal service , Or cause the network bandwidth of the data center entrance to be occupied , The entire data center cannot normally provide external services .

Due to the application layer DDoS There is no strict boundary between attack behavior and normal business behavior , Difficult to distinguish , So it is the most common , Financial institutions have suffered from different levels of application DDoS attack .Anonymous No one knows about the organization in the field of network security 、 No one knows . They are a group of young people all over the world , Have excellent network security knowledge , Not subordinate to any country or enterprise , Compared with ordinary hacker groups ,Anonymous An organization is more like a community , As long as you have the same idea or idea , Anyone can join in .

2018 end of the year ,Anonymous The organization launched a campaign code named Oplcarus Attack action , Encourage all anonymous activists to launch attacks on global banking websites . This action lasted for several months , A bank in China has also been attacked . The bank's dual data center deployment , Two centers share 8 strip ISP Line entrance , Network bandwidth of each portal 1GB, The network bandwidth of dual data centers is 8GB.Anonymous The organization found a static PDF resources , The size is 3.5MB, And then launch Web application DDoS attack , send out HTTP GET Request to get this static PDF resources .