DDoS Attack for Distributed Microservices

A Distributed Denial-of-Service (DDoS) attack is a malicious attempt to disrupt the normal traffic of a targeted server, service or network by overwhelming the target or its surrounding infrastructure with a flood of Internet traffic.

DDoS attacks achieve effectiveness by utilizing multiple compromised computer systems as sources of attack traffic. Exploited machines can include computers and other networked resources such as IoT devices.

 DDoS attacks are carried out with networks of Internet-connected machines.

These networks consist of computers and other devices (such as IoT devices) which have been infected with malware, allowing them to be controlled remotely by an attacker. These individual devices are referred to as bots (or zombies), and a group of bots is called a botnet. Once a botnet has been established, the attacker is able to direct an attack by sending remote instructions to each bot. When a victim’s server or network is targeted by the botnet, each bot sends requests to the target’s IP address, potentially causing the server or network to become overwhelmed, resulting in a denial-of-service to normal traffic. Because each bot is a authorized Internet device, separating the attack traffic from normal traffic can be difficult.

To identify our system is DDoS attacked; the most obvious symptom of a DDoS attack is a site or service suddenly becoming slow or unavailable. But since a number of causes; such a sudden spike in traffic that can create performance issues, further investigation is usually required. 

The key concern in mitigating a DDoS attack is differentiating between attack traffic and normal traffic.

There are few ways to tackle the DDoS attack;

Blackhole Route -: One solution available to virtually all network admins is to create a blackhole route and funnel traffic into that route. In its simplest form, when blackhole filtering is implemented without specific restriction criteria, both legitimate and malicious network traffic is routed to a null route, or blackhole, and dropped from the network.

Limiting -: Limiting the number of requests a server will accept over a certain time window is also a way of mitigating denial-of-service attacks.While rate limiting is useful in slowing web scrapers from stealing content and for mitigating brute force login attempts, it alone will likely be insufficient to handle a complex DDoS attack effectively.

Web Application Firewall (WAF) -: A WAF is a tool that can assist in mitigating a layer 7 DDoS attack. By putting a WAF between the Internet and an origin server, the WAF may act as a reverse proxy, protecting the targeted server from certain types of malicious traffic.By filtering requests based on a series of rules used to identify DDoS tools, layer 7 attacks can be impeded.

Anycast network Diffusion -: This mitigation approach uses an Anycast network to scatter the attack traffic across a network of distributed servers to the point where the traffic is absorbed by the network. Like channeling a rushing river down separate smaller channels, this approach spreads the impact of the distributed attack traffic to the point where it becomes manageable, diffusing any disruptive capability.