Denial-of-Service attack

Common characteristics and categories

DoS attacks vary by method and target. Three broad categories are often used:

• Volumetric attacks — consume bandwidth or network links by sending large amounts of data.
• Protocol attacks — exploit weaknesses in communication protocols or stateful resources to exhaust processing or connection tables.
• Application-layer attacks — mimic legitimate requests to overwhelm web servers or specific application functions.

Attacks may originate from a single machine (classic DoS) or from many compromised devices coordinated as a botnet, creating a distributed denial-of-service (DDoS) incident that is harder to block.

History and development

Techniques have evolved as networks and services became more complex. Early attacks simply flooded targets with traffic; over time, attackers developed more sophisticated protocol exploits and application-level strategies. The growth of always-connected devices and poorly secured consumer hardware has also expanded the pool of systems that can be co-opted into distributed attacks.

Impact and examples

Consequences range from temporary website outages to prolonged service disruption for online banking, e-commerce, streaming, and other critical services. Small or low-capacity connections, such as older dial-up links, can be affected disproportionately by even modest attacks; see dial-up as an example of limited-bandwidth access. Collateral damage can include disrupted communications for unrelated users sharing the same infrastructure.

Mitigation and defensive measures

Defenses combine technical controls, architecture choices, and operational practices. Typical measures include traffic filtering and rate-limiting, use of content delivery networks (CDNs) and distributed infrastructure to absorb spikes, specialized scrubbing services to remove malicious traffic, firewalls and intrusion prevention systems, and redundancy across geographic locations. Incident response often involves cooperation with upstream providers and network operators.

Distinctions and notable facts

DoS is distinct from unauthorized access or data theft; its primary objective is unavailability rather than intrusion. Distributed attacks complicate attribution because traffic may be relayed through many infected hosts. Legal frameworks in many jurisdictions treat deliberate DoS attacks as criminal acts when malicious intent can be demonstrated.