DDOS-GUARD. Q DDoS attack report

Transcription

1 DDOS-GUARD Q2 217 DDoS attack report

2 SECOND QUARTER 217 In the second quarter, June appeared to be the most eventful month, during which 242 DDoS attacks were detected. May was the least active month with its 1387 attacks occurred. In total, there were 549 attacks launched towards the DDoS-GUARD customers hourly daily 549 total Average size of all the attacks 3.9 GBPS / 1.9 MPPS IN COMPARISON with the 1st quarter of 217 attack amount attack size The amount of attacks reduced by 2.8%, the average size slightly dropped, by 14.5% with 216 There is a growth compared to the same period of 216 by 6.5 times. If measured in packets, the average attack size increased by 2.1 times as compared to the previous quarter, and by 9.5 times if compared to 216.

3 ATTACKS RATIO BY PROTOCOL TYPE The attack distribution by protocol is as follows: TCP Gbps / 2.2 Mpps UDP Gbps /.6 Mpps Others 351 Average size Average size Average size.1 Gbps /.3 Mpps Maximum size Gbps / 53.5 Mpps Maximum size 168 Gbps/39.5 Mpps Maximum size.98 Gbps / 2.6 Mpps The ratio between the quantity of attacks and protocol types has remained almost at the level of the previous quarter, however it should be noticed that the number of "Others" attacks (which includes attacks carried via ICMP, GRE, IPsec, etc.) increased by 5.7 times. However, when compared to the same period of the previous year, the ratio has changed much more noticeable: UPD - Second quarter, 216 TCP - Second quarter, 217 Others The number of UDP attacks increased by 31.3%, the number of TCP attacks increased by 1.9%, but the amount of attacks carried through other protocols decreased by 7.4 times! This allows us to conclude that DDoS attacks of this kind have lost their popularity during the year, but taking into account the tendency of these attacks in beginning of the year, they will long be in the arsenal of hackers.

4 The total number of large attacks (over Gbps) amounted to 4, which is by one attack greater than within the previous quarter and the same period last year. At the same time, attacks over 2 Gbps were not registered - for the first time over a long period. 4 LARGE ATTACKS (over Gbps) 168 THE LARGEST ATTACK OF THE QUARTER (peaked at 168 Gbps, UDP) occurred on June the 13th and lasted 7 minutes 12 seconds. 1 MINUTE THE SHORTEST ATTACK OF THE QUARTER The shortest attack lasted a little more than a minute. 3 HOURS THE LONGEST ATTACK OF THE QUARTER It targeted a Ukrainian hosting provider with parasitic traffic, size of which was growing and falling wave-like, peaking at 84 Gbps (63 Mpps). An interesting fact During the last quarter hackers conducted the most dangerous DDoS attacks on Tuesdays, Thursdays, and Sundays. The targeted internet service remained stable. Web hosting companies are often targeted with DDoS attacks, since by blocking the hosting, one can make unavailable all websites located on it.

5 RANKING OF VICTIMS * BY TYPE Online stores - 36% Online stores - 33% Hosting services - 21% 33% 36% Banks - 6% Governmental segment - 2% Mass media - 1.2% 21% Others -.8% An increase in the number of attacks on gaming projects, hosting providers, and "others" (media libraries, private sites, University websites etc.) was observed. Meanwhile, the number of attacks on media sites has dropped. TOP-TARGETED COUNTRIES * RUSSIA 18% CHINA 49% USA 22% REST OF THE WORLD 11% The leaders of the rating remained the same. There is a slight increase (1%) in attacks on the network infrastructures of Russian companies in comparison with the 1st quarter of 217. * among DDoS-GUARD customers

6 DYNAMICS IN THE NUMBER OF DDOS ATTACKS FOR THE QUARTER 33 attacks 18 attacks The most stormy day of the quarter - June 4, 217 (Sunday) The most quite day 14 April 217 (Friday) An interesting fact On May 7, 217 (Sunday) there were exactly attacks, a round number of attacks per day is quite rare. It should be noted that the intensity peaks of the attacks are not always tied to days of the week, but generally hackers are more active on Mondays, Thursdays and weekends than on other days, and on Saturdays there can be a both - a sharp decline as well as a big leap. The quarter looked as follows: DYNAMICS BY HOURS MON - TUE - WED - THU - FRI - SAT - SUN

7 C Lorem ipsum dolor sit amet, c Lorem Ipsum Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nullam eros. Lorem ipsum dolor sit amet, c DYNAMICS BY HOURS INFOGRAPHIC ELE DYNAMICS BY ATTACK AMOUNT % % INSERT TITLE HER Lorem ipsum dolor sit amet, ex eruditi corrumpit ea eos, ea no legimus adversarium eos, simu minim pericula ea. An mea aga consetetur. Ex quo ubique sing INSERT TITLE HER Lorem ipsum dolor sit amet, ex eruditi corrumpit ea eos, ea no legimus adversarium eos, simu minim pericula ea. An mea aga consetetur. Ex quo ubique sing INSERT TITLE HER Lorem ipsum dolor sit amet, ex eruditi corrumpit ea eos, ea no legimus adversarium eos, simu minim pericula ea. An mea aga consetetur. Ex quo ubique sing INSERT TITLE HER Lorem ipsum dolor sit amet, ex eruditi corrumpit ea eos, ea no legimus adversarium eos, simu minim pericula ea. An mea aga consetetur. Ex quo ubique sing INSERT TITLE HERE 2 LOREM IPSUM DOLOR LOREM I 15 % % IN IN The maximum number of attacks occurs at 15:, in the evening at 2:, and the least number of attacks - at 4 in the morning. SUMMARY GRAPHS IN IN

8 ENTS us inciderint, a. In nibh pro, eum ex qui prima us inciderint, a. In nibh pro, eum ex qui prima INSERT TITLE HERE Lorem ipsum dolor sit amet, ex mel affert inciderint, eruditi corrumpit ea nonumy discere mea. In nibh legimus adversarium eos, simul soluta verear ut pro, eum minim pericula ea. An mea agam dicit senserit, ex qui prima consetetur. Ex quo ubique singulis. Mei autem alterum vituperata at, eius altera ceteros mei in, duo ad autem vidisse Wisi aeterno vis no. Quis quod etiam te has. Falli partem suscipiantur vis cu. Sit cibo augue eu. Sit te dolorem noluisse. Solum atqui vocibus duo in, te mel erant dolores posidonium. 9 LOREM IPSUM DOLOR LOREM IPSUM DOLOR TLE 5 TLE TLE TLE 6 5 sanctus eos, ea us inciderint, a. In nibh pro, eum ex qui prima 6 us inciderint, a. In nibh pro, eum ex qui prima R MON - TUE - WED - THU - FRI - SAT - SUN The summary graph shows which hours of each day of the week were the most and least intense in the last quarter. Activity bursts of hackers occurred in the evening of Thursday, Friday, and Saturday. On Monday and Tuesday afternoons had most of attacks. The least number of attacks happened on Tuesdays at 5-6 AM, Wednesdays at 4-5 AM, and Thursdays at 3 and 5 AM.

9 TENDENCIES 1 AMPLIFIED DDOS ATTACKS During the reporting period there have been detected DDoS attacks with amplification (strengthening), so it is too early to consider them as outdated types of cyber attacks. 2 INCREASE IN THE NUMBER OF MULTI-VECTOR ATTACKS Noticed an increase in the number of multi-vector attacks (involving multiple protocols), which fully corresponds with tendencies and projections of the previous year. To repel these attacks a sophisticated protection algorithms must be applied. 3 PERCENTAGE GROWTH OF DDOS ATTACKS OVER VARIOUS PROTOCOLS A minor percentage growth in DDoS attacks is detected over ICMP, GRE, IPsec, etc. (except UDP and TCP). 4 GENERAL DECREASE IN THE NUMBER OF ATTACKS The reduction in the number of attacks is attributable to the decrease in the number of DoT ( DDoS of Things - the DDoS attacks generated by IoT botnets) that have made a significant contribution at the end of early 217. However, they are being replaced by Windows bots, and after a traditionally silent summer season, you can expect a jump in the number and power of DDoS attacks.

10 FORECAST In the holiday season and summer vacations, we can predict an increase in the number of DDoS attacks on gaming servers and media libraries that broadcast popular TV shows, because their audience will grow due to vacationers, and this is the moment when hackers can inflict maximum damage. In addition, there is a possibility of attacks aimed at university websites due to the beginning of the academic year. ABOUT US DDoS-GUARD is a licensed communications service provider specialized in DDoS protection services to customers all over the world since 211. The data presented in this report has been collected by the automatic statistics system and analyzed by the company engineers.

11 OUR CUSTOMERS Join us and ensure informational security of your business today!

12 #ddos-guard