Application Layer DDoS attack

An application layer DDoS attack is a type of distributed denial of service (DDoS) attack that aims to disrupt the services of a web application or server by overloading the application layer (layer 7 of the OSI model) resources. 

What is the OSI model? 

The OSI model (Open Systems Interconnection Model) is a theoretical layer model that describes how data is transmitted and processed in a network. It consists of seven layers, with each layer performing specific functions and interacting with the layer above or below it. 

The characteristics of an application layer DDoS attack

One key characteristic is that the attack specifically targets the application layer where users interact with services. Typical targets include HTTP requests to websites, APIs, and databases as well as specific functions such as login pages or search boxes. Unlike volumetric attacks, which overwhelm networks with huge amounts of data, an application layer DDoS attack aims to exhaust server-side resources such as CPU power, memory, or database capacities. 

These attacks can be very efficient because they often require little bandwidth. Even a small botnet or a limited number of malicious actors can cause significant damage. Another key feature is the attack’s ability to mimic legitimate traffic. The requests appear to be normal user actions, such as loading a web page or sending a form. This makes them extremely difficult to detect and defend against, since traditional security solutions such as firewalls or intrusion detection systems (IDS) cannot easily identify malicious traffic. 

Application layer DDoS attacks can also be very precise. Attackers specifically select application vulnerabilities that are particularly resource-intensive. One example is overloading a complex search function or repeatedly triggering database-intensive queries. This targeted overburdening results in legitimate users no longer being able to access the application or having to accept severely limited loading times. 

There are also variants such as the so-called “low-and-slow” attacks. Here, requests are sent very slowly in order to keep the connection open for as long as possible and thus permanently block resources. These attacks, such as the “slowloris” attack, are particularly difficult to detect because they require little bandwidth and often remain inconspicuous. 

Examples of application layer DDoS attacks

There are various examples of application layer DDoS attacks, each focusing on specific protocols, applications or features. These attacks are designed to overwhelm server-side resources such as CPU, RAM or databases by attacking the application layer (layer 7) of the OSI model.  

HTTP flood attack 

An HTTP flood attack overwhelms a server with a large number of seemingly legitimate HTTP or HTTPS requests, such as GET or POST requests. The goal is to overload the server’s resources, such as CPU or memory, to the point where it can no longer process legitimate requests. Because the attack resembles normal user activity, it is difficult to detect and defend against. 

Slowloris attack 

The Slowloris attack involves opening incomplete connections to a web server by sending deliberately slow requests and never completing them. This leaves server resources such as connections or threads blocked, preventing new requests from being processed. This attack requires little bandwidth, is difficult to detect, and can effectively paralyze even high-performance servers. 

DNS query flood 

A DNS query flood attack aims to overwhelm DNS servers by sending a huge volume of DNS queries. Often, fake or non-existent domain names are requested, which can completely exhaust the server’s processing capacity. The result is that legitimate users can no longer resolve domain names, preventing access to websites and other Internet-based services. 

API abuse 

API abuse involves targeting APIs of an application with a high volume of requests. These requests can trigger resource-intensive processes such as database queries or reports, thereby exhausting server capacity. The attack is often directed against public or poorly secured API endpoints. In addition to overloading the system, such attacks can also compromise sensitive data if vulnerabilities in the API are exploited. 

How can you protect against application layer DDoS attacks?

Protecting against application layer DDoS attacks requires a targeted and comprehensive strategy, as these attacks target application layer vulnerabilities and are often difficult to distinguish from regular user traffic.  

One of the most important measures is the use of a web application firewall (WAF) that analyzes incoming traffic and filters malicious requests. WAFs are designed to detect unusual patterns, such as an unusually high number of HTTP requests to specific endpoints, and can block them at an early stage. In addition, traffic filtering is an effective approach to distinguish between legitimate users and bots. With the help of CAPTCHAs or behavioral analysis, for example, suspicious activity can be identified and stopped. 

Another protective measure is rate limiting, which limits the number of requests per user in a given period. This prevents attackers from sending a large number of requests and overloading server resources. Load balancing can be used to minimize the load on individual servers.  

This involves distributing the data traffic across several servers or geographically remote data centers, which not only distributes the load more evenly but also increases resilience. Content delivery networks (CDNs) play an important role here, as they distribute data traffic across global locations while also ensuring faster loading times. 

Anomaly detection systems based on machine learning or heuristic methods are also an essential part of an effective defense strategy. These systems monitor traffic in real time, detect uncharacteristic activity such as sudden spikes or repeated resource-intensive requests, and block them. In addition, scalable infrastructure, for example by using cloud services, can mitigate the effects of an attack.  

Measures can also be taken at the DNS level to ward off attacks such as DNS query floods. DNS DDoS protection services can filter traffic at the DNS level and block malicious queries before they reach the application. In addition to this, the use of IP whitelisting and blacklisting is useful to ensure that only trusted IP addresses are granted access to sensitive endpoints such as admin areas or APIs. 

For functions such as login pages or search fields, it is recommended that these be secured by additional protective mechanisms such as CAPTCHAs, login rate limits, or multi-factor authentication.  

In addition, the infrastructure should be secured by redundancy and failover strategies so that, in the event of an attack, it can automatically switch to alternative servers or data centers. Regular security updates and patch management are also essential to close known vulnerabilities in software and frameworks and to avoid offering attackers a target.  

Share this post