Using DDoS Protection Without Affecting Legitimate Users

Reading Time: 4 minutes

The use of DDoS protection that does not affect legitimate users is a serious concern for all online businesses. DDoS (also known as Distributed Denial of Service) poses a unique challenge to the security of websites because such attacks generally also consist of several individual requests that are legitimate.

These requests become an attack simply because of the sheer volume of requests all taking place at the same time.

Using DDoS Protection Without Influencing Authorized Users

1. The Problem

One of the biggest problems when trying to mitigate DDoS attacks is trying to distinguish between legitimate traffic and that which is genuinely malicious.

If a legitimate user is wrongly flagged as malicious – something referred to as a false positive – this means that a real user will be denied service. On the flip side, if a malicious user is wrongly identified as legitimate, the door could have been opened for many more cyber-attacks that are likely to go undetected.

It is hence imperative that any DDoS protection that is employed can distinguish between malicious and legitimate users, but how can this be achieved?

2. Avoid Rate Limitation

Anti-DDoS solutions that offer protection based upon rate limitation methods have been in use for a long time, but are now outdated and unable to deal with new situational challenges.

A static, pre-defined traffic threshold is used to create a rate limitation, but this brings two significant problems. The first major problem is that it is unable to mitigate any attacks until the traffic has crossed that set threshold, meaning that it is slow to detect attacks and may fail to recognize them if they do not.

The other big drawback of a rate limitation solution is that once it begins to mitigate any suspicious traffic, it also has a negative effect on everyone’s quality of user experience. Not all traffic rate increases are caused by malicious attacks, meaning that the supposed DDoS protection solution can block legitimate traffic.

More advanced and managed DDoS protection that offer more sophisticated solutions for attacks are required, including the likes of 

• challenge-response mechanisms and
• behavioural analysis.

3. The Benefits of Behavioural Analysis As DDoS Protection

Application transactions are followed by behavioural analysis, which creates an understanding of the workings of the application to differentiate between legitimate and malicious users. The frequency and number of events are taken into consideration to define baseline application behaviour.

Data is accumulated during an attack, and then a comparison is made between that data and the baseline behaviour model.

In the event of the detection of suspicious behaviour, this will trigger a more in-depth process of inspection to perform an analysis of application-level parameters and decide whether the suspicious activity is a real burst of legitimate traffic or the result of a malicious attack.

4. The Benefits of Challenge-Response As DDoS Protection

The employment of a challenge-response mechanism as a managed DDoS protection solution challenges any suspect sources. It will then make a decision whether those sources are real users or bots depending on the response.

CAPTCHA, the system where users are required to type digits or letters from an image on the screen to show that they are a real user and not a bot, is an excellent example of challenge-response mechanisms. This test means that undesirable internet bots cannot access websites as they cannot process the letters’ image.

The challenge-response mechanism is useful as the DDoS protection solution launches a variety of queries in response to a request source. Then, it decides to flag the user as malicious or send further challenges depending on the response it receives.

Challenge-response mechanisms use automated processes, so no human intervention is needed either from the source or the managed DDoS protection solution.

The correct use of behavioural analysis and a challenge-response mechanism can almost entirely remove false positives and ensure that legitimate users will continue to be given a superb quality experience.

Wrapping it up

While almost anyone can achieve rate-limiting traffic to particular applications and prevent floods on them, the result of such an approach is to deny legitimate users your service, with such disruption often being the desired objective of the attackers.

The use of advanced DDoS protection solutions is the only real way to ensure differentiation between legitimate users and attackers during such attacks and provide the best service to real online customers.

Employing a specialist provider’s services such as Indusface is the best choice for any organization to ensure the successful implementation of an advanced DDoS protection solution.