DDoS protection and mitigation is a set of techniques implemented across an enterprise to mitigate DDoS traffic. A Denial of Service (DoS attack is a methodology to flood resources of victims with false requests and make them unable to serve legitimate requests. A DDoS attack is induced by a collection of devices used to target a network and application layer or induce volumetric attacks, ranging from 1 Gbps to 1 Tbps. The DDoS protection and mitigation market includes solutions, such as hardware solutions and software solutions. The solutions are developed on algorithms that make use of Machine Learning (ML), Artificial Intelligence (AI), and big data analytics methodologies. The software solutions are supported by a scrubbing center that distinguishes good and bad traffic with minimal latency and false positives. The services segment, on the other hand, augments the smooth functioning of solutions by aiding in implementation and design, support and maintenance, training and education, and consulting. The strong competition among top players and introduction of new entrants who are focused on R&D activities make DDoS Protection Software more beneficial for customers in terms of features and pricing.

DDoS Protection Software vendors are placed into 4 categories based on their performance and reviews in each criterion: “visionary leaders,” “innovators,” “dynamic differentiators,” and “emerging companies".

Vendors who fall in the category of visionary leaders generally receive high scores for most of the evaluation criteria. They have a strong portfolio of solutions and services and mark their presence in the DDoS protection software space by offering solutions as per the consumer requirements. These vendors have undertaken various growth strategies to advance consistently in the market. The visionary leaders in DDoS protection software include NETSCOUT, Akamai Technologies, Imperva, and Huawei Technologies.

Dynamic differentiators are established vendors with strong business strategies. However, they do not possess strong product portfolio. The vendors generally focus on a specific type of technology related to the product. F5 Networks and Nexusguard are recognized as dynamic differentiators in the DDoS protection and mitigation space. The vendor have an innovative portfolio of solutions and services. They also have an extensive network of channel partners and resellers to integrate in the market and increase the deployment of their solutions across a multitude of vertical markets. Moreover, the business strategy of these companies is strong, and have partnered with strong players to expand their market reach. The dynamic differentiators have been consistent in generating positive revenue growth in the DDoS protection and mitigation market, and their market position is boosted by the organic and inorganic growth ventures undertaken by them.

The innovators in the MicroQuadrant are vendors who have demonstrated substantial product innovations in comparison to their competitors. They have focused product portfolios. However, they do not have strong growth strategies for their overall business. Verisign, Fortinet, Cloudflare, and Neustar are recognized as the innovators in the DDoS protection and mitigation space. They possess innovative solutions to cater to future mobility demands. These companies are concerned about their product portfolio, and have a robust potential to build strong business strategies for expanding their business and stay at par with the visionary leaders. These vendors have been consistently offering DDoS protection and mitigation market solutions to fulfill customer demands. Innovators have also been at the forefront for the development of innovative DDoS protection and mitigation solutions.

Emerging companies are vendors with niche product offerings who are beginning to gain their position in the market. They do not have strong business strategies as compared to other established vendors. These companies might be new entrants in the market and require some more time before they gain a significant market traction. Most of the emerging companies have undertaken multiple business strategies to boost their capabilities across regions and offer integrated solutions and services to a wide range of clients. A10 Networks, NS Focus, Radware, Stackpath and Oracle are recognized as emerging companies in the DDoS protection Software and mitigation space.

DDoS attacks disturb the normal functioning of the network by flooding the network and causing congestion. The network-layer and transport-layer functioning gets affected due to attack vectors, such as User Datagram Protocol (UDP) flood, SYN flood, NTP amplification, DNS amplification attacks, and others. The illegitimate traffic on the network over 40 gigabit per second (Gbps) is sufficient enough to cause the entire network breakdown in enterprises. The botnets are computers that are capable of receiving requests without intervention from authorized personnel.

The botnets flood the network with numerous illegitimate requests. Botnets can utilize packets from the Transmission Control Protocol (TCP), UDP, and Internet Control Message Protocol (ICMP). Some of the major DDoS attacks on the network include DNS amplification attack, NTP attack, smurf attack, ping flood, SYN flood, and RUDY attacks. Smurf attacks broadcast packets to all computers in the network, thereby consuming network bandwidth. Ping flood sends the computer with a number of ping commands, causing a disturbance in the network and also leading to system crash. DNS amplification attacks cause congestion on the target system using DNS response traffic and thereby disturbing the target system.

Advanced DDoS protection Software and mitigation solutions and services are required to safeguard enterprises from the malicious layer 3 and layer 4 protocol packets, packet headers, and the illegitimate requests generated. The advanced solutions and services safeguard enterprises from volumetric attacks and do not allow bandwidth consumption due to illegitimate traffic.

APPLICATION

The layer 7 is widely attacked by cyber threats such as DDoS, malware, APTs, and others. The application layer deals with protocols such as Simple Mail Transfer Protocol (SMTP), HTTP, and HTTPS, which are responsible for managing web browsers, emails, or handling requests for applications.

DDoS attacks aimed at layer 7 try to flood the layer with illegitimate requests and disrupt the application. An HTTP flood attack on the application layer can leverage the same page request over and over again, affect the large pool of IP addresses, and disrupt the functioning of network and resources. WordPress XMLRPC Floods uses WordPress pingback for causing flood requests and disturbances. An attacker can generate, on average, 6,000–7,000 HTTP requests per second, which may be prolonged from 5 minutes to 24 hours.

DDoS Protection Software and services with support from industry experts and support teams are required for advanced protection from DDoS attacks.

DATABASE

Along with the increase in network and application DDoS attacks, database-related DDoS attacks and Structured Query Language (SQL) injections are also increasing. The attacks on the database are difficult to detect and can cause the crashing of the database. Some of the databases have had issues with invalid object pointers, workload manager vulnerability, and also issues related to unrestricted network access, which can lead to file corruption. Complex database queries, usage of infinite for loop, usage of in operator, the Cartesian product on large datasets, and join operation performed on large datasets can exhaust a database’s resources, memory, and also the processing power of the system.

Some of the methodologies adopted in mitigating database DDoS attacks include limiting resources on a per-user basis, active monitoring, patching, database firewalls, web application firewalls, and database abstraction layer hardening.

ENDPOINT

DDoS attacks on endpoints such as workstations, servers, and mobile devices aim to waste the CPU resources and memory and cause system breakdown. The DDoS attacks can flood the endpoint resources with illegitimate traffic and can also target vulnerabilities in the application stack, which can block legitimate traffic from completing its cycle.