Distributed Denial of Service, commonly abbreviated as DDoS, is a type of cyberattack that aims to make a website, server, application, network or online service unavailable to legitimate users. In a DDoS attack, the target system is overwhelmed by heavy traffic, requests or connection attempts coming from many sources. This load can consume bandwidth, processing capacity, memory resources or application services, causing service disruption. Cloudflare defines a DDoS attack as an attempt to disrupt the normal traffic of a targeted server, service or network by overwhelming it with a flood of internet traffic.
The main difference between a DDoS attack and a DoS attack is that DDoS traffic comes from many sources rather than a single source. Attackers often use botnets made up of compromised computers, servers, IoT devices, cameras, routers or other networked resources. This distributed structure makes the attack harder to detect and harder to stop by blocking only one source. For this reason, DDoS is a serious availability and business continuity risk, especially for organizations that generate revenue online or provide critical services.
DDoS attacks do not target only e-commerce websites, online gaming platforms or betting websites. Banks, media organizations, public institutions, SaaS platforms, telecom companies, financial services, healthcare systems, education platforms and API-based services can also be targeted. The motivation behind attacks may include financial gain, extortion, political motivation, hacktivism, damaging competitors, service sabotage, distraction or testing security capacity. Therefore, DDoS attacks should be treated not only as a technical issue but also as an operational and commercial risk.
DDoS attacks are generally divided into three main categories: volumetric attacks, protocol-based attacks and application-layer attacks. CISA categorizes DDoS techniques into volumetric, protocol and application groups. Similarly, the Canadian Centre for Cyber Security explains DDoS attacks under these three broad categories based on the network layers they target. This classification is important for understanding which resource the attack is trying to exhaust and which defensive methods may be required.
Volumetric DDoS attacks focus on consuming the bandwidth of the target or the network path leading to the target. UDP Flood and ICMP/Ping Flood attacks are examples of this category. In these attacks, a very large amount of data packets is sent to the target in an attempt to fill network capacity. The goal is to make it difficult or impossible for legitimate user traffic to reach the target system. Volumetric attacks are often visible through very high traffic volume and may require strong network-level filtering, CDN, anycast infrastructure or DDoS protection services.
Protocol-based DDoS attacks attempt to consume protocol handling or connection management resources at the network and transport layers. SYN Flood is one of the best-known examples of this type of attack. These attacks may target not only bandwidth, but also resources in firewalls, load balancers, server TCP/IP stacks or connection tables. An important correction is that OSI is not a type of DDoS attack. The OSI model is a reference model used to describe network communication in layers; DDoS attacks can target different resources across these layers.
Application-layer DDoS attacks target the application layer, commonly referred to as Layer 7 of the OSI model. Scenarios such as HTTP GET/POST Floods, overloading login pages, abusing search functions or generating expensive API requests can fall into this category. These attacks may sometimes appear low-volume because the traffic can consist of valid-looking requests that resemble normal user behaviour. Cloudflare states that application-layer DDoS attacks target the application layer to disrupt the normal flow of traffic to a website or service.
Technical terms such as UDP Flood, Ping Flood, SYN Flood and HTTP Flood are frequently used in DDoS discussions, but they should be understood as examples under broader attack categories rather than separate main categories. UDP Flood and Ping Flood are usually evaluated under volumetric attacks, while SYN Flood belongs to protocol or state-exhaustion attacks. HTTP GET/POST Flood is an example of an application-layer attack. If an attack uses multiple methods at the same time, it can be described as a multi-vector DDoS attack.
There is no single and definitive defense method against DDoS attacks. Effective protection requires network, application, DNS, CDN, firewall, WAF, rate limiting, traffic monitoring and incident response processes to be designed together. OWASP explains that denial-of-service attacks can be carried out in many ways across different layers and aim to make resources unavailable. For this reason, defense should be handled through a layered security architecture rather than a single product.
For volumetric attacks, high bandwidth capacity, CDN, anycast routing, upstream filtering and DDoS scrubbing services can be useful. For protocol attacks, firewall rules, SYN cookies, connection limits, load balancer configurations and proper network device configuration become important. For application-layer attacks, WAF, bot management, behavioural analysis, endpoint-level rate limiting, CAPTCHA or challenge-response mechanisms, caching strategies and application optimization can be used. However, if these controls are configured incorrectly, they can also negatively affect real user experience.
Organizations should prepare before a DDoS attack happens. Critical services, API endpoints, payment systems, login pages, DNS records and CDN configurations should be reviewed. Traffic thresholds, normal traffic profiles, alerting mechanisms, logging, load testing, capacity planning and incident response plans should be created. It should be clear in advance who will take which action during an attack, how the service provider will be contacted and how customers will be informed.
DDoS tests and stress tests should also be conducted carefully. Organizations may want to test the capacity of their own systems and defense mechanisms, but such work should be performed only with legal authorization, explicit permission, controlled scenarios and professional security teams. Unauthorized traffic testing or experiments that may affect third-party systems can create legal and operational problems. Therefore, DDoS resilience testing should be planned in line with security policies and service provider agreements.
DDoS attacks cannot always be completely prevented, but their impact can be reduced. The goal is not only to stop the attack, but also to maintain service continuity, separate legitimate user traffic, keep critical systems running and perform post-incident analysis. After an attack, traffic sources, targeted endpoints, attack duration, vectors used, defense system performance and business impact should be reviewed. This analysis helps create a stronger defense plan for future incidents.
In summary, DDoS is a serious cyberattack type that aims to make a target system unavailable by overwhelming it with traffic or requests from many sources. Volumetric, protocol-based and application-layer attacks target different resources and require different defense approaches. Effective protection requires CDN, WAF, rate limiting, traffic monitoring, DDoS protection services, capacity planning and incident response processes to be managed together. DDoS security is not a one-time test, but a business continuity issue that requires continuous monitoring and resilience planning.
