Denial of Service

Additional scientific description

A Denial of Service (DoS) renders a computer system or network unavailable to its intended users by overwhelming it with external inputs (e.g., incoming web traffic), in which cases it takes the name of Distributed Denial of Service (DDoS) or exploiting its vulnerabilities to exhaust the computational resources. This disruption denies users access to services and information, causing significant operational and financial impacts (CISA, 2021).

Distributed denial of service (DDoS) attacks remain a persistent nuisance on the Internet. They exploit the fact that the Internet lacks centralized access control. Since this vulnerability was a core design decision of the early Internet, DDoS attacks have persisted. Early attacks were related to hacker culture, but their focus quickly changed to commercial exploitation. There have also been a number of political uses of DDoS, including cyberwar, hacktivism, and terrorism (Brooks et al, 2021).

The use of DoS and DDoS is well documented in cybersecurity history. Early attacks can be found already in the early internet era, with one of the first incidents occurring in France in 1995, followed the next year by a major incident against Panix, a New York City-based internet service provider (Brooks et al, 2021). Over the years, these attacks have evolved in complexity and scale, exemplified by the 2016 botnet attack powered by Mirai malware, which leveraged Internet of Things (IoT) devices to launch a massive DDoS attack, disrupting major websites worldwide (CISA, 2017). 

DoS can result from human errors (such as misconfiguration), other incidents (such as power failure), or deliberate attacks. Various techniques are employed in DoS attacks. The primary distinction lies between DoS and DDoS attacks. A DoS attack usually originates from a single source targeting a system, while a DDoS attack involves multiple compromised systems, often forming a botnet, to flood the target simultaneously, making defence significantly more challenging. The increasing number of connected devices - especially in the context of the Internet of Things (IoT) boom - is also increasing the risk of DDoS attacks occurring since each connected device can potentially become part of a botnet. 

A denial-of-service (DoS) attack occurs when legitimate users are unable to access information systems, devices, or other network resources due to the actions of a malicious cyber threat actor. A denial-of-service condition floods the targeted host or network with traffic until the target cannot respond or simply crashes, affecting email, websites, online accounts (e.g., banking), or other services. DoS attacks can cost an organization both time and money while their resources and services are inaccessible.

DoS attacks can be further categorized based on method: volume-based attacks overwhelm the bandwidth of a network (e.g., flooding a website with excessive traffic), whereas attacks exploiting computational limitations involve sending malformed requests or initiating infinite loops to exhaust computational resources. 

DoS attacks can escalate to national hazards when they target critical infrastructure. A precedent is the 2007 cyber-attacks on Estonia, where coordinated DDoS attacks crippled government, banking, and media websites, leading to widespread disruption and highlighting vulnerabilities at the national level (Ottis, 2008). 

DoS attacks are commonly employed by malicious actors due to their relative ease of execution and potential for significant disruption. Every year, data registers large numbers of DoS and DDoS incidents, making them one of the most prevalent forms of cyber-attack (Bergamini de Neira et al, 2023). In 2024, NETSCOUT reported over 13 million DDoS attacks globally, with rising trends in multi-vector attacks (NETSCOUT, 2024).