2024-01-12-Cloudflare-2023年第二季度_DDoS_攻击趋势报告_15页_1mb

报告摘要

Cloudflare DDoS Threat Report - Q2 2023 Summary

Executive Summary

Cloudflare's Q2 2023 DDoS report highlights a surge in customized and persistent DDoS attacks targeting various sectors. Key trends include the rise of low-traffic HTTP attacks, DNS meth laundering, exploits using the Mitel vulnerability, and the shift to high-performance VM/VPS-based bots. Attack traffic decreased overall but saw regional and sector-specific increases. Recommendations focus on proactive mitigation strategies.

Key Findings

Darknet Parliament Coalition: A hacker alliance formed by Killnet, REvil, and Anonymous Sudan launched thousands of attacks on Western financial targets, though banking was not among the top industries hit.
Low-Frequency HTTP DDoS Attacks: These attacks increased, characterized by randomized user behavior to evade detection, peaking in traffic requests per second.
DNS Meth Laundering: This became the most common DDoS method, accounting for 32% of attacks, where malicious traffic is disguised to appear legitimate.
Startblast Attack: Exploits the Mitel zero-day vulnerability (CVE-2022-26143) for UDP amplification, targeting IT and service providers significantly.
Rise of High-Performance Botsnets: Virtual machine-based bots replaced IoT devices, enabling larger-scale attacks, with initial cooperation from cloud providers to mitigate threats.

Attack Trends

Traffic Changes: Overall DDoS traffic decline; HTTP layer attacks decreased by 35% year-over-year but increased by 15% month-over-month.
Most Attacked Countries: US, Singapore, and Canada top in application layer; China leads in network layer, with high malicious traffic share.
Industry Vulnerabilities: Cryptocurrency and gaming sites face the most attacks; non-profits are also heavily targeted, with daily attacks averaging 67.7 million.

Recommendations

Update DDoS mitigation plans with dynamic detection, ML-based analysis, and threat intelligence.
Ensure enough capacity for attack buffering and use content delivery networks for better performance.
Employ proactive models, pattern validation, and rate limiting to defend against emerging threats.

展开完整摘要