Security researchers said they fended off a distributed denial-of-service (DDoS) attack in January of more than 500 million packets per second, which might constitute the largest of its kind ever publicly disclosed.

In a blog post, Imperva said the incident involved a syn flood, otherwise known as a series of Transmission Control Protocol (TCP) connection requests, which overloaded the capabilities of the machine or network in question. This was followed by an even larger syn flood containing packets of between 800 and 900 bytes.

Though the identities of those responsible aren’t known, researchers said they believe the DDoS attack was launched by two people who wrote tools that spoofed and randomized the traffic involved.

Measuring DDoS Attack Intensity

While the attack was mitigated and the customer was not mentioned by name, the researchers suggested that the incident offered a case for rethinking the way DDoS attacks are measured. Network bandwidth that reached 1.35 Tbps, for example, led several experts to classify an attack on Github as the largest-ever DDoS incident in 2018.

Given that mitigation requires inspecting every single packet head, however, the researchers argued that the volume of packets per second, not their size, becomes the bigger issue because of the network resources required. The Github incident, for example, involved a relatively low rate of 1.26 million packets per second and is something that could therefore be potentially contained by traffic filtering or an appliance, the researchers said.

The incident in January, meanwhile, put researchers on alert because packets were malformed as their parameters were randomized. This was likely a mistake caused by the attackers’ tools that were supposed to replicate real operating systems.

DDoS Attack Mitigation in the Cloud

As more organizations shift their IT infrastructure from on-premises servers to those hosted in a private, public or hybrid cloud, the potential impact of DDoS attacks could be even greater.

In fact, IBM experts pointed out that volume-based, protocol and application-layer attacks are all among the potential DDoS variants. Fortunately, these can be mitigated through a number of different means, from DDoS traffic scrubbing to the use of next-generation firewalls or content delivery networks.

More from

Most organizations want security vendor consolidation

4 min read - Cybersecurity is complicated, to say the least. Maintaining a strong security posture goes far beyond knowing about attack groups and their devious TTPs. Merely understanding, coordinating and unifying security tools can be challenging.We quickly passed through the “not if, but when” stage of cyberattacks. Now, it’s commonplace for companies to have experienced multiple breaches. Today, cybersecurity has taken a seat in core business strategy discussions as the risks and costs have risen dramatically.For this reason, 75% of organizations seek to…

How IBM secures the U.S. Open

2 min read - More than 15 million tennis fans around the world visited the US Open app and website this year, checking scores, poring over statistics and watching highlights from hundreds of matches over the two weeks of the tournament. To help develop this world-class digital experience, IBM Consulting worked closely with the USTA, developing powerful generative AI models that transform tennis data into insights and original content. Using IBM watsonx, a next-generation AI and data platform, the team built and managed the entire…

How the FBI Fights Back Against Worldwide Cyberattacks

5 min read - In the worldwide battle against malicious cyberattacks, there is no organization more central to the fight than the Federal Bureau of Investigation (FBI). And recent years have proven that the bureau still has some surprises up its sleeve. In early May, the U.S. Department of Justice announced the conclusion of a U.S. government operation called MEDUSA. The operation disrupted a global peer-to-peer network of computers compromised by malware called Snake. Attributed to a unit of the Russian government Security Service,…

How NIST Cybersecurity Framework 2.0 Tackles Risk Management

4 min read - The NIST Cybersecurity Framework 2.0 (CSF) is moving into its final stages before its 2024 implementation. After the public discussion period to inform decisions for the framework closed in May, it’s time to learn more about what to expect from the changes to the guidelines. The updated CSF is being aligned with the Biden Administration’s National Cybersecurity Strategy, according to Cherilyn Pascoe, senior technology policy advisor with NIST, at the 2023 RSA Conference. This sets up the new CSF to…