Millions of targets under attack

TLDR

Denial‑of‑Service attacks have surged in frequency and intensity, posing a major threat to Internet stability, yet a comprehensive characterization and effective countermeasures remain challenging. The authors introduce a new framework to enable a macroscopic characterization of attacks, attack targets, and DDoS Protection Services. The framework analyzes data from four global measurement sources—network‑telescope backscatter, amplification honeypot logs, a DNS platform covering 60 % of the namespace, and a DNS‑based dataset on DPS adoption—over the past two years. The study finds that one‑third of all /24 networks have suffered at least one DoS attack in the last two years, that targets are often hit by multiple attack types, that web servers are the most prominent target with roughly 3 % of .com/.net/.org sites affected daily, and that factors influencing migration to DPSs were identified.

Abstract

Denial-of-Service attacks have rapidly increased in terms of frequency and intensity, steadily becoming one of the biggest threats to Internet stability and reliability. However, a rigorous comprehensive characterization of this phenomenon, and of countermeasures to mitigate the associated risks, faces many infrastructure and analytic challenges. We make progress toward this goal, by introducing and applying a new framework to enable a macroscopic characterization of attacks, attack targets, and DDoS Protection Services (DPSs). Our analysis leverages data from four independent global Internet measurement infrastructures over the last two years: backscatter traffic to a large network telescope; logs from amplification honeypots; a DNS measurement platform covering 60% of the current namespace; and a DNS-based data set focusing on DPS adoption. Our results reveal the massive scale of the DoS problem, including an eye-opening statistic that one-third of all / 24 networks recently estimated to be active on the Internet have suffered at least one DoS attack over the last two years. We also discovered that often targets are simultaneously hit by different types of attacks. In our data, Web servers were the most prominent attack target; an average of 3% of the Web sites in .com, .net, and .org were involved with attacks, daily. Finally, we shed light on factors influencing migration to a DPS.