Prerequisites

What Makes an Attack Distributed

A denial-of-service attack exhausts a finite resource so legitimate requests cannot be served. It becomes distributed when traffic originates from many sources simultaneously, which defeats the obvious defense of blocking the offender.

The attacker's objective is simply to push offered demand above available capacity at the narrowest point in the system. That point may be bandwidth, connection slots, CPU, memory, database connections, or a third-party dependency.

The Three Attack Layers

Volumetric Attacks

Volumetric attacks saturate the network path. The target's servers may be entirely healthy, but the pipe leading to them is full, so legitimate packets are dropped before arrival.

Amplification and Reflection

Attackers rarely possess the bandwidth to flood a large target directly. Instead they abuse protocols where a small request produces a large response, and forge the source address so the response lands on the victim.

Protocol Attacks

Protocol attacks exhaust connection state rather than bandwidth. They exploit the fact that a server must allocate memory before knowing whether a client is genuine.

client_header_timeout   8s;
client_body_timeout     8s;
send_timeout            10s;
keepalive_timeout       15s;

limit_conn_zone $binary_remote_addr zone=perip:10m;
limit_conn perip 24;

limit_req_zone $binary_remote_addr zone=reqs:10m rate=20r/s;
limit_req zone=reqs burst=40 nodelay;

Application-Layer Attacks

These are the hardest to defend. Requests are well-formed, often authenticated, and individually indistinguishable from normal use. The attacker targets asymmetry: requests that cost little to send but a great deal to serve.

The higher this ratio, the fewer attackers are needed. An endpoint where one request triggers a large scan, complex aggregation, or third-party call is far more attractive than a cached static resource.

Layered Defense Architecture

Caching as a Defense

Caching is among the most effective and least discussed mitigations. Every request served from cache is a request the origin never processes.

A high hit ratio means attack traffic against cacheable content is largely absorbed. Attackers therefore attempt to bypass cache deliberately.

Distinguishing Attackers from Users

Since application-layer traffic looks legitimate, defense depends on accumulating weak signals rather than finding one decisive indicator.

Progressive Response

function selectResponse(signals, systemState) {
    const score = computeRiskScore(signals);

    if (systemState.underAttack && score > 0.9) {
        return { action: "block", reason: "high-confidence attack" };
    }

    if (score > 0.7) {
        return { action: "challenge", type: "proof-of-work" };
    }

    if (score > 0.5) {
        return { action: "challenge", type: "lightweight" };
    }

    if (score > 0.3 && systemState.loadFactor > 0.8) {
        return { action: "throttle", delayMs: 400 };
    }

    return { action: "allow" };
}

Proof of Work and Challenges

Challenges invert the cost asymmetry. The client must perform work before the server commits resources, which is negligible for one user and prohibitive across a botnet.

{
    "challengeId": "chl-7f2a91",
    "algorithm": "sha256-prefix",
    "prefix": "a3f91c",
    "difficulty": 20,
    "issuedAt": "2026-09-24T05:02:11Z",
    "expiresAt": "2026-09-24T05:04:11Z"
}

Load Shedding and Degradation

When demand exceeds capacity despite every filter, the system must choose what to abandon. Shedding deliberately is far better than failing arbitrarily.

function admissionControl(request, metrics) {
    const pressure = Math.max(
        metrics.cpuUtilization,
        metrics.queueDepth / metrics.queueCapacity,
        metrics.dbConnectionsInUse / metrics.dbConnectionLimit
    );

    if (pressure < 0.7) {
        return { admit: true };
    }

    const priority = classifyPriority(request);
    const threshold = SHED_THRESHOLDS[priority];

    if (pressure > threshold) {
        return {
            admit: false,
            status: 503,
            retryAfterSeconds: 30,
            reason: `shedding ${priority} traffic at ${pressure.toFixed(2)}`
        };
    }

    return { admit: true, degraded: pressure > 0.85 };
}

Autoscaling Is Not a Defense

Scaling to meet attack traffic converts an availability problem into a financial one. The service stays up while costs rise without limit, which some attacks specifically intend.

DNS as a Target

DNS is frequently overlooked. If name resolution fails, the application is unreachable regardless of how well the application tier is defended.

Detection and Monitoring

Detection must distinguish an attack from a legitimate traffic surge, because the correct response differs entirely.

Incident Response

Common Design Mistakes

System Design Interview Discussion

Preparedness Checklist

Knowledge Check

Summary

Distributed denial-of-service attacks exhaust a finite resource from many sources at once. They operate at three layers: volumetric attacks saturating bandwidth, protocol attacks consuming connection state, and application attacks exploiting the cost asymmetry between sending and serving a request.

Each layer must be handled where capacity exists to absorb it. Volumetric floods require distributed edge capacity and upstream scrubbing, protocol attacks require connection termination with strict timeouts, and application attacks require identity-aware, cost-weighted limits at the service tier.

Caching is an underrated defense, since every cached response is one the origin never processes. Attackers therefore target cache bypass, which makes key normalization, negative caching, and stale delivery important hardening measures.

Because application-layer traffic resembles legitimate use, defense depends on layered weak signals feeding graduated responses rather than binary blocking. When demand still exceeds capacity, priority-based shedding preserves critical paths while sacrificing non-essential functionality deliberately.