What is an HTTP flood attack?

An HTTP flood attack is a special form of DDoS attack (Dis­trib­uted Denial of Service). The attacker attempts to crash the targeted website or ap­plic­a­tion through a huge number of visits from different locations. An HTTP flood attack is often called a layer 7 attack. Layer 7 refers to the “ap­plic­a­tion layer” in the OSI model, which states that the internet consists of 7 layers.

An attack at this level consists of depriving the network or server of its resources. As soon as the hardware no longer has suf­fi­cient resources available, the responses to requests through the client require more time. Because countless requests continue to be sent to the hardware, a constant over­load­ing of the system is caused and the server or entire network are no longer reachable.

When attackers utilise an HTTP flood, they attempt to cause a server crash via requests that are com­pletely standard. How does this HTTP process become a dangerous attack?

As it def­in­itely can happen that a page receives a lot of valid traffic, it is difficult to know whether the increased number of requests stem from an attack or are only the result of a suc­cess­ful marketing campaign. If an HTTP flood attack is detected, however, firewalls can identify and block the sus­pi­cious IP adresses.

As a first step, you can send a JavaS­cript Challenge back to the client. This will allow you to analyse whether the client belongs to a botnet or a regular user. Unlike bots, every browser for a normal user can deal with this ad­di­tion­al hurdle.

If the attacker’s strategy is known, simple rules can be in­tro­duced into the firewall system that auto­mat­ic­ally block the botnet’s IP address. Normally, an HTTP flood can be iden­ti­fied and stopped in just a few minutes once you know that this is the cause of the system failure.

It is difficult to protect oneself from an HTTP flood attack, as the requests initially look like normal traffic on the website. No malware is sent to the server and there are no attempts to exploit possible security gaps. Instead, the attackers flood the server with au­thor­ized accesses. Because this uses con­sid­er­ably less bandwidth than a sub­stan­tial in­filt­ra­tion into the page code, the attacks are mostly un­re­cog­nised in the early stages.

Most websites have recourse to a captcha test that must be manually executed by a real user. In this way, a botnet can be iden­ti­fied be­fore­hand, and the IP addresses can be blocked. However, there are also firewalls for websites and ap­plic­a­tions. These systems review and analyse the traffic that arrives at the website. They only slow your website minimally, and in exchange guarantee your pro­tec­tion and stability. Should the site itself already be data- and process-intensive, there is the option of in­teg­rat­ing a loading screen while the homepage loads in the back­ground.