DDOS attacks less frequent last year, more dangerous
San Francisco-based Black Lotus, a DDOS mitigation firm, saw a total of 1.14 million different attacks last year, with an "alarming" surge in the last quarter of the year.
The average bit volume of each attack -- the number of packets, multiplied by the size of each packet -- increased 3.4 times compared to the third quarter of the year.
In addition, it was the first time that Black Lotus saw average attack size pass 10 gigabits per second, reaching an average of 12.1 Gbps in the fourth quarter, up from just 2.7 Gbps at the start of the year.
This isn't bad news for Black Lotus, which is in the business of protecting organizations from the largest attacks. But it is bad news for enterprises doing their own DDOS mitigation.
"If people are trying to defend their own network using an on-premise device, they typically don't have the capacity to exceed 20 gigabits," said Frank Ip, the company's VP of marketing and business development.
In other bad news, the complexity of attacks has already increased.
"There is a continuous trend of people combining different attacks together, in hybrid attacks," Ip said.
"We're also seeing more application-layer attacks," he added. "Even though those are smaller in size, they are not smaller in terms of effect or damage to the targeted victim."
While network attacks try to use up all the network bandwidth, application attacks target just one application's resources, he explained.
"These are much easier to over run," he said.
In fact, he said, the increased sophistication of the attacks may explain, in part, why there are fewer of them.
"They're being more efficient," he said. "They don't have to lodge as many attacks to accomplish what they have to accomplish."
There was also some good news last year, he added.
Attacks that used compromise servers to magnify the size of the attack are almost completely gone, he said.
"All the operators and companies that ran DNS and servers have patched up all the loopholes," he said. "There are no more vulnerable servers available to generate those large volumes."