What is HTTP flood attack?

HTTP flood attack is a volumetric DDoS attackDistributed Denial-of-Service attack designed to overwhelm a target with HTTP requests. Once the target is saturated with requests and cannot respond to normal traffic, DoSDenial-of-Service attack will occur for additional valid user requests.

How does an HTTP flood attack work?

HTTP flood attacks are indistinguishable from valid traffic since they use standard URL requests. These attacks often rely on a botnetA network of interconnected computers or devices. to maximize the attack's impact. The following are the two types of HTTP flood attacks:

• HTTP GET attack: In this attack, the bots are coordinated to send multiple requests for an asset from the targeted server. When the target is overwhelmed with incoming requests and responses, DoS will occur to additional requests from legitimate traffic sources.

• HTTP POST attack: In this attack, many POST requests are directed towards the targeted server until its capacity is saturated and DoS occurs.

Detection of HTTP flood attacks

To distinguish attack traffic from valid user requests, it is essential to understand the content of the requests and put them in context. Modern protection systems analyze all incoming requests before they reach the web server. This enables them to detect abnormal traffic patterns automatically and ward off HTTP flood attacks early.

Mitigation of HTTP flood attacks

Once the HTTP flood attack has been detected, the associated requests can be blocked. This leaves the server with sufficient resources to respond to all valid requests. A verification process can also ensure that valid requests are not blocked. After successful verification, they're forwarded to the server.

HTTP flood attacks can be prevented by using anti-DDoS software, dispersing the traffic, configuring firewalls, black hole routing, and using rate limitations.