On Denial of Service Attacks

On Denial of Service Attacks

I was thinking about this attack pattern after reading about the DDoSattack on theMillion Dollar Homepage. The site's owner was asked for $50,000 in exchange for the attack being halted.
It is clear, to me at least, that steps should be taken to prevent DDoS attempts at some point in the network where the bandwidth can cope. This is, usually, before it hits the destination server. Firewall hardware on the main connection to an ISP is one of the best places to block such attempts, but the problem arises from the distributed nature of these attacks. It is not a matter of blocking a single IP address, or even a single range, and trying to block all of the subnets usually prevents legitimate users accessing the site, which is what the attackers intended all along.

One approach to preventing this would be to detect IP addresses which are repeatedly sending the same data to the same place, such as large ping packets going to the same hosted server, or patterns in the traffic, and selectively block or delay such packets with respect to legitimate packets from IP addresses seen much less frequently, usually characteristic of real site visitors.
Another approach is to drop unwanted packets directly, rather than wasting time and resources replying to those packets, and to prioritise based on protocol - giving HTTP priority over e.g. ICMP.

Of course, this doesn't prevent attacks which utilise a large number of HTTP connections, filling the server's connection pool and preventing other users establishing a link to the server, but there are often modules for the web server software itself which can detect such activity and prioritise traffic, or drop connections which fit a certain characteristic pattern.
Distributed Denial of Service attacks are almost impossible to entirely block or prevent, but measures are easily introduced which can limit their effectiveness. Ultimately, the real source must be determined in order to stop such an attack, but this usually means tracing connections back through several computers which have been used without the owner's knowledge, usually by means of remote control software installed silently. Performing such a trace is difficult at best, and even authorities struggle to reach the end of the chain and determine the real source.