The Kaspersky Lab DDoS Q4 Report covering statistics of the last quarter and the whole of 2018 highlights a 13% decline in the overall number of DDoS attacks compared with the previous year’s statistics. However, the duration of mixed and HTTP flood attacks is growing, which suggests that malefactors are turning to more sophisticated DDoS attack techniques.<\/p>\n\n\n\n
DDoS-as-hire’s low cost makes such attacks one of the most affordable cyberweapons for evil competitors or internet trolls. Businesses, regardless of their size or industry, can face this threat and suffer revenue and reputation losses if legitimate users and customers cannot access the company\u2019s web resources. Despite the number of DDoS attacks falling in 2018, it\u2019s too early to rejoice as the decrease in the number of attacks does not mean a decrease in their severity.<\/p>\n\n\n\n
According to Kaspersky Lab researchers, as more and more organizations adopt solutions to protect themselves from simple DDoS attacks, 2019 will likely see attackers improve their expertise to overcome standard DDoS protection measures and bring the overall complexity this type of threat to the next level.<\/p>\n\n\n\n
Although the number of attacks is decreasing, Kaspersky Lab experts’ analysis has found that the average attack duration is growing. Compared with the beginning of the year, the average length of attacks has more than doubled \u2013 from 95 minutes in Q1 to 218 minutes in Q4. It is notable that UDP flood attacks (when the attacker sends a large number of UDP packets to the target\u2019s server ports to overwhelm it and make it unresponsive for clients), which are accounting for almost half (49%) of the DDoS attacks in 2018, were concise and rarely lasted more than 5 minutes.<\/p>\n\n\n\n
Kaspersky Lab experts assume that the decline in UDP flood attacks’ duration illustrates that the market for easier to organize attacks is shrinking. Protection from DDoS attacks of this type is becoming widely implemented, making them ineffective in most cases. The researchers propose that attackers launched numerous UDP flood attacks to test whether a targeted resource is not protected. If it immediately becomes clear that attempts are not successful, malefactors stop the attack.<\/p>\n\n\n\n
Simultaneously, more complex attacks (such as HTTP misuse), which require time and money, will remain long. As the report revealed, the HTTP flood method and mixed attacks with HTTP components, which shares were relatively small (17% and 14%), constitute about 80% of the whole year’s DDoS attack time.<\/p>\n\n\n\n
\u201cWhen most simple DDoS attacks do not achieve their aim, those people earning money by launching such attacks have two options. They can reconfigure the capacities required for DDoS attacks towards other sources of revenue, such as crypto mining. Alternatively, malefactors who orchestrate DDoS attacks have to improve their technical skills, as their customers will look for more experienced attackers. Given this, we can anticipate that DDoS attacks will evolve in 2019, and it will become harder for companies to detect them and stay protected,\u201d\u2013 comments Alexey Kiselev, Business Development Manager on the Kaspersky DDoS Protection team.<\/p>\n\n\n\n
Regarding results from the last quarter, the longest DDoS attack in Q4 lasted 329 hours (almost 14 days) \u2013 such a long attack was last registered at the end of 2015.<\/p>\n\n\n\n
The top three counties which had the most conducted DDoS attack remain the same. In the first place, China is again, but its share dropped significantly from 77.67% to 50.43%. The US remains Australia still occupies second and third place.<\/p>\n\n\n\n
By target distribution, China still tops the list, but its share declined to 43.26% (70.58% in Q3).
In Q4, there have also been changes in the countries hosting the most C&C servers. As in the previous quarter, the US remained the leader, but the UK and the Netherlands came second and third, replacing Russia and Greece, respectively. This is likely because the number of active C&C Mirai servers is increasing significantly in the aforementioned countries.<\/p>\n\n\n\n
Kaspersky Lab recommends the following steps to protect an organization from DDOS attacks:
Train personnel to respond to such incidents properly;
Ensure that a company’s websites and web applications can handle high traffic;
Use professional security solutions to protect against attacks.<\/p>\n","protected":false},"excerpt":{"rendered":"
The Kaspersky Lab DDoS Q4 Report covering statistics of the last quarter and the whole of 2018 highlights a 13% decline in the overall number of DDoS attacks compared with the previous year’s statistics. However, the duration of mixed and HTTP flood attacks is growing, which suggests that malefactors are turning to more sophisticated DDoS […]<\/p>\n","protected":false},"author":13,"featured_media":9584,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_meta-robots-noindex":"","_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","_pr_autopilot_social_copy":"","_yoast_wpseo_opengraph_title":"","_yoast_wpseo_opengraph_description":"","_yoast_wpseo_opengraph_image":"","_yoast_wpseo_opengraph_image_id":0,"_yoast_wpseo_twitter_title":"","_yoast_wpseo_twitter_description":"","_yoast_wpseo_twitter_image":"","_yoast_wpseo_twitter_image_id":0,"_yoast_wpseo_primary_category":439,"_extra_hide_author_box":"","_extra_featured_post":"","_partner_post_id":0,"footnotes":""},"categories":[439],"tags":[],"class_list":["post-9585","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","et-has-post-format-content","et_post_format-et-post-format-standard"],"yoast_head":"\n