Different Types of Denial of Service (DoS) Attacks & Their Mitigations
Different Types of Denial of Service (DoS) Attacks & Their Mitigations
拒绝服务 (DoS) 攻击的类型及其缓解措施
Disclaimer: This article is intended for educational purposes related to cybersecurity, defensive security, and authorized security testing only. DoS/DDoS testing should only be conducted against systems, applications, networks, or lab environments where explicit authorization has been provided. 免责声明： 本文仅用于与网络安全、防御性安全及授权安全测试相关的教育目的。DoS/DDoS 测试仅应在获得明确授权的系统、应用程序、网络或实验环境中进行。
Introduction Denial of Service (DoS) attacks target availability by exhausting a system or network resource, disrupting a service, or exploiting a weakness that causes a service to become unavailable. A Distributed Denial of Service (DDoS) attack uses multiple distributed sources to achieve the same objective. The attack surface extends from network bandwidth and TCP state to HTTP services, APIs, databases, cloud resources, and vulnerable application components. One can classify these attacks by the resource they target and the layer at which the disruption occurs. This makes their mitigation easier to understand and apply. 引言 拒绝服务 (DoS) 攻击通过耗尽系统或网络资源、中断服务或利用漏洞导致服务不可用，从而破坏可用性。分布式拒绝服务 (DDoS) 攻击则利用多个分布式来源来实现相同的目标。攻击面涵盖了从网络带宽和 TCP 状态到 HTTP 服务、API、数据库、云资源以及易受攻击的应用程序组件。我们可以根据攻击目标资源和中断发生的层级对这些攻击进行分类，这使得理解和应用缓解措施变得更加容易。
1. Volumetric Attacks Volumetric attacks attempt to consume the available network capacity of the target. The application and underlying servers may remain operational, but legitimate traffic cannot reach them because the network path is saturated. Common examples include UDP floods, ICMP floods, and large packet floods. Mitigation generally needs to occur before traffic reaches the organization’s network. Rate limiting, upstream filtering, CDN-based protection, Anycast distribution, traffic scrubbing, and dedicated DDoS protection services are commonly used. 1. 容量耗尽型攻击 (Volumetric Attacks) 容量耗尽型攻击试图消耗目标可用的网络容量。尽管应用程序和底层服务器可能仍在运行，但由于网络路径被饱和，合法流量无法到达。常见的例子包括 UDP 洪水攻击、ICMP 洪水攻击和大包洪水攻击。缓解措施通常需要在流量到达组织网络之前实施。常用的手段包括速率限制、上游过滤、基于 CDN 的保护、任播 (Anycast) 分发、流量清洗以及专门的 DDoS 防护服务。
2. UDP Floods UDP floods generate large volumes of UDP packets toward a target. Since UDP does not require the same connection establishment process as TCP, attackers can generate significant packet volumes without maintaining conventional sessions. The resulting impact can include bandwidth exhaustion, packet-processing overhead, and excessive work on firewalls, routers, or servers. Internet-facing UDP services should be reviewed regularly because unnecessary exposure increases the attack surface. 2. UDP 洪水攻击 UDP 洪水攻击向目标发送大量 UDP 数据包。由于 UDP 不需要像 TCP 那样的连接建立过程，攻击者可以在不维护常规会话的情况下产生巨大的数据包流量。其影响包括带宽耗尽、数据包处理开销增加，以及防火墙、路由器或服务器的负载过重。应定期审查面向互联网的 UDP 服务，因为不必要的暴露会增加攻击面。
3. ICMP and Ping Floods ICMP is essential for several networking functions, but excessive ICMP traffic can consume bandwidth and processing capacity. A ping flood is a straightforward example where the target receives unusually high volumes of ICMP echo requests. The appropriate response is generally rate limiting and traffic profiling rather than blindly blocking ICMP. For larger attacks, filtering at the network edge or through an upstream DDoS mitigation provider is more effective than relying entirely on the destination host. 3. ICMP 和 Ping 洪水攻击 ICMP 对于多种网络功能至关重要，但过量的 ICMP 流量会消耗带宽和处理能力。Ping 洪水攻击是一个典型的例子，即目标接收到异常高频的 ICMP 回显请求。应对措施通常是进行速率限制和流量分析，而不是盲目地封禁 ICMP。对于大规模攻击，在网络边缘进行过滤或通过上游 DDoS 缓解服务商进行处理，比完全依赖目标主机更为有效。
4. TCP SYN Floods A TCP SYN flood abuses the connection-establishment process. Large numbers of connection attempts can cause a server or network device to maintain excessive incomplete connection state. The attack primarily targets connection-handling capacity rather than simply consuming bandwidth. Common defenses include SYN cookies, connection limits, TCP timeout controls, stateful filtering, load balancing, and upstream DDoS protection. Monitoring TCP connection states is also important. A sudden increase in incomplete connections can indicate malicious activity, although the traffic must always be evaluated against normal application behavior. 4. TCP SYN 洪水攻击 TCP SYN 洪水攻击滥用了连接建立过程。大量的连接尝试会导致服务器或网络设备维护过多的未完成连接状态。该攻击主要针对连接处理能力，而非仅仅消耗带宽。常见的防御措施包括 SYN Cookies、连接限制、TCP 超时控制、状态检测过滤、负载均衡和上游 DDoS 防护。监控 TCP 连接状态也很重要。未完成连接的突然增加可能预示着恶意活动，尽管必须始终结合正常的应用程序行为来评估流量。
5. TCP Connection and State Exhaustion DoS attacks can target TCP resources beyond SYN processing. Excessive established, half-closed, or abnormal connections can consume connection tables, memory, file descriptors, worker threads, or other server resources. This type of attack can affect firewalls and load balancers as well as application servers. Mitigation includes appropriate connection limits, timeout policies, stateful filtering, load balancing, and sufficient capacity. Network appliances should be monitored independently because an overloaded firewall or load balancer can cause an outage even when backend systems remain healthy. 5. TCP 连接和状态耗尽攻击 DoS 攻击可以针对 SYN 处理之外的 TCP 资源。过多的已建立、半关闭或异常连接会消耗连接表、内存、文件描述符、工作线程或其他服务器资源。此类攻击不仅会影响应用程序服务器，还会影响防火墙和负载均衡器。缓解措施包括设置合理的连接限制、超时策略、状态检测过滤、负载均衡以及确保足够的容量。网络设备应被独立监控，因为即使后端系统运行正常，过载的防火墙或负载均衡器也可能导致服务中断。
6. Reflection Attacks Reflection attacks use third-party systems to generate traffic toward the victim. An attacker manipulates requests so that responses are directed to the intended target. This allows the attacker to use legitimate Internet services as intermediaries. Mitigation involves both protecting the victim and preventing internal infrastructure from becoming a reflector. Organizations should restrict unnecessary services, secure exposed protocols, prevent spoofed traffic where possible, and use upstream DDoS filtering. CISA recommends controls such as stateful UDP inspection, upstream coordination, and measures against source-address spoofing when responding to reflective attacks. 6. 反射攻击 反射攻击利用第三方系统向受害者发送流量。攻击者操纵请求，使响应被导向预定的目标。这使得攻击者能够利用合法的互联网服务作为中介。缓解措施包括保护受害者，以及防止内部基础设施成为反射器。组织应限制不必要的服务，保护暴露的协议，尽可能防止欺骗性流量，并使用上游 DDoS 过滤。CISA 建议在应对反射攻击时采取状态检测 UDP 检查、上游协调以及针对源地址欺骗的防御措施。
7. Amplification Attacks Amplification attacks are a form of reflection attack where a small request generates a substantially larger response. Historically abused protocols include DNS, NTP, CLDAP, SSDP, and Memcached. The defensive priority is to prevent exposed infrastructure from acting as an amplifier. Unnecessary UDP services should be disabled or restricted, recursive services should not be unnecessarily exposed, and rate controls should be applied where appropriate. For organizations being targeted, upstream traffic filtering and DDoS mitigation are generally required because amplification attacks can exceed the capacity of the victim’s network connection. CISA provides guidance on UDP-based amplification attacks and recommends controls including ingress filtering and restricting unnecessary UDP services. 7. 放大攻击 放大攻击是一种反射攻击，其中较小的请求会产生大得多的响应。历史上常被滥用的协议包括 DNS、NTP、CLDAP、SSDP 和 Memcached。防御重点是防止暴露的基础设施充当放大器。应禁用或限制不必要的 UDP 服务，不应无故暴露递归服务，并在适当情况下应用速率控制。对于被攻击的组织，通常需要上游流量过滤和 DDoS 缓解，因为放大攻击可能会超过受害者网络连接的承载能力。CISA 提供了关于基于 UDP 的放大攻击的指南，并建议采取包括入口过滤和限制不必要 UDP 服务在内的控制措施。
8. DNS Query Floods DNS infrastructure can be targeted directly through excessive query volumes. Attacks can affect authoritative DNS servers, recursive resolvers, or supporting infrastructure. DNS availability is particularly important because many other services depend on successful name resolution. Mitigation includes DNS rate limiting, resilient DNS architecture, caching, Anycast distribution, access controls, and dedicated DNS/DDoS protection. Recursive DNS services should not be unnecessarily available to arbitrary Internet clients. DNS monitoring should also track unusual query volumes, query types, response patterns, and… 8. DNS 查询洪水攻击 DNS 基础设施可能因过量的查询流量而直接受到攻击。攻击可能影响权威 DNS 服务器、递归解析器或支撑基础设施。DNS 的可用性尤为重要，因为许多其他服务都依赖于成功的域名解析。缓解措施包括 DNS 速率限制、弹性 DNS 架构、缓存、任播分发、访问控制以及专门的 DNS/DDoS 防护。递归 DNS 服务不应无故向任意互联网客户端开放。DNS 监控还应跟踪异常的查询量、查询类型、响应模式等。