Skip to content
AI360Xpert

DDoS Protection

DDoS Protection architecture
DDoS Protection architecture

Overview

A Distributed Denial of Service (DDoS) attack attempts to make an online service unavailable by overwhelming it with traffic from multiple sources. DDoS protection involves deploying network and application-level defenses to absorb, filter, and block malicious traffic while allowing legitimate users through.

🧠 Mental model: Imagine a thousand fake customers swarming a tiny coffee shop just to stand in line and order nothing, preventing real customers from getting coffee. DDoS protection is the bouncer at the door checking IDs and quickly turning away the fakes so the real line keeps moving.

Key Concepts

Types of DDoS Attacks

  • Volumetric Attacks (Layer 3/4): Brute force bandwidth consumption. E.g., UDP floods, ICMP (Ping) floods. Goal: clog the network pipes.
  • Protocol Attacks (Layer 3/4): Exploiting weaknesses in network protocols. E.g., SYN floods (leaving half-open TCP connections until the server runs out of memory to track them).
  • Application Layer Attacks (Layer 7): Simulating legitimate user behavior. E.g., HTTP GET/POST floods (hitting an expensive database query repeatedly). These are the hardest to detect because the requests look real.

Defense Mechanisms

Effective defense relies on a multi-layered approach, typically offloaded to a specialized edge provider (like Cloudflare, AWS Shield, or Akamai) because their network capacity dwarfs the attack volume.

  • Anycast Routing: Scattering the incoming traffic across a globally distributed network of servers to absorb the volume.
  • Rate Limiting: Dropping requests from IPs that exceed a certain threshold of requests per second.
  • Web Application Firewall (WAF): Inspecting Layer 7 traffic to block known malicious payloads, botnet signatures, or unexpected geographic regions (Geo-blocking).
  • Challenges (CAPTCHA/JS execution): Forcing the client to prove it is a real browser/human before allowing it to hit the backend.

Trade-offs

Relying on third-party DDoS protection (like Cloudflare) routes all your traffic through them, meaning you must trust them with your TLS certificates (they can see your unencrypted traffic). Strict WAF rules and rate limits can result in false positives, blocking legitimate users or APIs during legitimate traffic spikes. The cost of advanced Layer 7 protection is also high, often scaling with bandwidth.

Interview Tips

  • Never try to architect your own volumetric DDoS defense on your own servers; you will lose. Always say "We use an Edge/CDN provider like Cloudflare or AWS Shield to absorb Layer 3/4 attacks."
  • For Layer 7 attacks, mention rate limiting at the API Gateway and Web Application Firewalls (WAF).
  • Distinguish between stopping a brute-force bandwidth attack (needs Anycast) vs. a smart application attack (needs WAF/Rate Limiting).

Summary

  • DDoS attacks overwhelm a service with traffic to cause downtime.
  • Layer 3/4 attacks clog the network or exploit protocols (SYN floods).
  • Layer 7 attacks target application logic (HTTP floods) and are harder to detect.
  • Defense requires massive network capacity, usually provided by edge services like Cloudflare.
  • Key tools include Anycast routing, Rate Limiting, and Web Application Firewalls (WAF).