Distributed Denial of Service

A Distributed Denial of Service (DDoS) attack is a coordinated attempt to exhaust the resources or bandwidth of a target system or network by overwhelming it with traffic from multiple compromised or controlled sources.

Expanded Explanation

1. Technical Function and Core Characteristics

A DDoS attack uses numerous hosts to send large volumes of network packets, connection requests, or application-layer requests toward a specific target. The goal is to degrade or block the target’s ability to process legitimate traffic.

Attackers often leverage botnets, misconfigured services, or reflection and amplification techniques to multiply traffic volume. Common DDoS vectors include volumetric floods, protocol attacks on network and transport layers, and application-layer attacks that consume server resources.

2. Enterprise Usage and Architectural Context

Enterprises address DDoS risk through layered network and application architectures that incorporate traffic scrubbing, rate limiting, and filtering at edge locations and upstream providers. Security teams integrate DDoS detection into monitoring, logging, and incident response workflows.

DDoS protections operate in conjunction with content delivery networks, web application firewalls, and load balancers to maintain availability of Internet-facing services. Many organizations use upstream mitigation services that reroute and clean traffic before it reaches enterprise networks or data centers.

3. Related or Adjacent Technologies

DDoS attacks intersect with intrusion detection systems, intrusion prevention systems, and Security Information and Event Management (SIEM) platforms that analyze traffic patterns and trigger alerts. Network telemetry, flow records, and packet capture support investigation and tuning of defenses.

Other adjacent domains include botnet detection, Domain Name System (DNS) security, and routing security measures such as Border Gateway Protocol (BGP) filtering and source address validation. Traffic Engineering (TE) and anycast routing also contribute to distributing load and absorbing attack traffic.

4. Business and Operational Significance

DDoS events can interrupt access to customer-facing applications, APIs, and online services, which affects revenue collection, service-level commitments, and user experience. These attacks also consume operational resources as teams coordinate mitigation and recovery.

Enterprises treat DDoS as a core availability and resilience risk and incorporate it into business continuity planning, third-party risk assessments, and cyber insurance considerations. Regulatory frameworks and industry guidelines reference DDoS preparedness as part of broader operational resilience and cybersecurity programs.