A Distributed Denial-of-Service (DDoS) attack is a malicious attempt to disrupt the normal functioning of a server, network, web application, etc., by overwhelming the target or its surrounding infrastructure with malicious traffic through a number of simultaneous, coordinated Denial-of-Service (DoS) attacks.
Layer 7 (L7) DDoS attacks, also known as application layer DDoS attacks, target the processes operating at the top layer of the OSI model. Unlike network layer (L3) and transport layer (L4) attacks that focus on the core network equipment and firewalls, respectively, L7 DDoS attacks aim directly at the servers that run web applications.
Application layer attacks can be particularly damaging because malicious traffic can look very similar to legitimate user traffic. This makes it harder to detect and mitigate such attacks. Another dangerous feature of L7 DDoS attacks is that they require much less magnitude to be successful.
Although there are a lot of protocols that are included in the application layer of the OSI model, just two of them are usually targeted by L7 DDoS attacks:
An honorable mention goes to DNS and NTP protocols, which are also part of the application layer of the OSI model. These protocols are frequently exploited by DDoS attackers, particularly in DNS and NTP amplification attacks. However, the actual targets in these attacks are the core network equipment, such as routers, that work with Internet Protocol (IP). Therefore these attacks are classified as network layer (L3) DDoS attacks.
Application layer (L7) DDoS attacks exploit the resource-intensive nature of processing HTTP and HTTPS requests. The complexity of handling HTTP and the additional computational power required for HTTPS decryption make these protocols particularly vulnerable, allowing attackers to maximize their impact while overwhelming web servers.
On top of that, as we mentioned earlier, malicious HTTP and HTTPS traffic highly resemble legitimate user traffic, making it much harder to detect and handle the attack. This is especially true for HTTPS traffic because it is extremely challenging to differentiate between legitimate and malicious requests without decryption.
The overall goal of an L7 DDoS attack is to exhaust the resources of the servers running the web application, causing them to become slow, unresponsive, or completely unavailable to legitimate users.
This can be done in several ways. One is to flood the targeted servers with a massive amount of garbage HTTP/HTTPS requests. Another is to overwhelm the server's capacity with a small number of specially crafted requests, cleverly using peculiarities of the protocols. Yet another way is to concentrate traffic from a large number of fake users that, formally speaking, is legitimate, while being useless from a business perspective and overall harmful to a targeted server.
From a practical standpoint, it is convenient to distinguish three categories of L7 DDoS attacks: slow HTTP attacks, massive attacks that use botnets, and hacktivism. Let's briefly discuss each of them.
Slow-rate L7 DDoS attacks, also known as "Low and slow," rely on clever exploitation of protocol features to exceed a server's capacity without spending too many resources on the attacker's end. Here are the most notable examples of slow HTTP attack tools:
The most massive L7 DDoS attacks use botnets consisting of large numbers of compromised devices. These attacks rely on the collective power of the botnet to generate massive amounts of HTTP/HTTPS requests, overloading the targeted servers.
Last but not least, DDoS attacks are often organized by hacktivists — groups with shared ideologies that use cyberattacks to express their protest. Hacktivists leverage a combination of techniques to perpetrate DDoS attacks, utilizing slow HTTP attack tools, botnets, and pseudo-legitimate user traffic coming from their mobilized followers.
To make matters worse, hacktivist DDoS attacks are often accompanied by hacking attempts, content theft, and other malicious activities.
Successful Denial-of-Service attacks, particularly L7 DDoS attacks, can significantly disrupt business operations, financial stability, and company reputation.
Financial impact: L7 DDoS attacks lead to immediate financial losses due to web application downtime and the cost of recovery. Businesses may also incur expenses related to regulatory fines, compensating affected customers, and paying ransom to attackers, as DDoS attacks have become increasingly popular among ransomware gangs.
Operational impact: Successful L7 DDoS attacks cause the unavailability of web applications, severely disrupting normal business operations. Additionally, they divert resources to managing and mitigating the aftermath of the attack.
Reputational impact: Beyond direct damage, a successful L7 DDoS attack can have long-lasting effects on a company's reputation. Customers may lose trust and loyalty due to perceived unreliability, and negative publicity can lead to lost business opportunities and increased customer attrition.
From a practical standpoint, businesses have a few options when it comes to layer 7 DDoS protection:
