Denial of Service

What Is Denial of Service (DoS) Attack?

A denial of service (DoS) attack is a cyberattack that makes a website, application, server, or network unavailable to legitimate users. Attackers may overwhelm a target with traffic, exhaust system resources, or exploit software vulnerabilities that cause a service to slow down, hang, or crash.

A DoS attack typically originates from a single source, while a distributed denial of service (DDoS) attack uses multiple systems to overwhelm a target. DDoS attacks often rely on botnets made up of compromised computers, servers, and Internet of Things (IoT) devices.

DoS attacks primarily affect availability, one of the three core principles of confidentiality, integrity, and availability (CIA) triad. Service disruptions can prevent customer access, interrupt business operations, and affect service-level agreements. Because some attacks exploit vulnerabilities or send resource-intensive requests rather than generate high traffic volumes, effective protection requires both network defenses and strong vulnerability management.

Why Denial of Service Attacks Are a Security Concern for Enterprises

Enterprise systems rely on the availability of applications, APIs, cloud workloads, and network services. A successful denial of service attack can disrupt these services, limit customer access, and increase operational costs, even when no data is stolen.

The impact can extend beyond service disruption. Attackers may use an outage as a distraction for credential theft, lateral movement, or data exfiltration. Some campaigns also use ransom-based DDoS threats to pressure organizations into paying to prevent or stop an attack.

Cloud environments face additional risks when attacks trigger repeated autoscaling or excessive application and AI model requests, driving infrastructure costs. This is sometimes called a denial-of-wallet attack, where service usage exhausts financial resources. Financial services, healthcare, government, SaaS providers, online retailers, gaming platforms, and critical infrastructure can all be affected, making it essential to protect both network capacity and application resources.

How a DoS Attack Works

A denial-of-service attack works by consuming a resource that a service needs to respond to legitimate requests. The targeted resources may be network bandwidth, CPU, memory, connection state, application threads, API quotas, or another processing limit.

A typical attack follows these stages:

1. Identify a target or weakness. The attacker selects a website, server, API, network service, or vulnerable application component.
2. Generate traffic or crafted requests. The attacker sends large volumes of packets or requests, opens numerous connections, or exploits a software flaw.
3. Exhaust available resources. Network links become saturated, connection tables fill, application threads stall, or CPU, and memory usage rise.
4. Disrupt legitimate access. Users experience slow responses, timeouts, service errors, or complete outages.
5. Continue until mitigation takes effect. The attack ends when the attacker stops or the organization and its providers filter the traffic, limit requests, or address the exploited vulnerability.

Not every denial-of-service attack follows this exact sequence. A vulnerability-based attack, for example, may crash into a service with a single crafted request rather than relying on sustained traffic volume.

Types of Denial-of-Service Attacks

DoS attacks are classified by the resources they target and the techniques they use. The main types are volumetric, protocol-based, application-layer, and vulnerability-based attacks.

Volumetric Attacks

Volumetric attacks overwhelm network bandwidth with large volumes of traffic, preventing legitimate requests from reaching the target. Examples include UDP floods, ICMP floods, and DNS or NTP amplification attacks. MITRE ATT&CK classifies network denial of service under T1498.

Protocol-Based Attacks

Protocol-based attacks exploit how network protocols handle connections and packets, exhausting resources such as connection tables and firewall state. A SYN flood, for example, leaves systems managing incomplete TCP connections. MITRE ATT&CK includes operating system exhaustion floods under T1499.001.

Application-Layer Attacks

Application-layer attacks target web servers, APIs, and application functions with requests that consume excessive processing resources. Examples include HTTP floods, Slowloris attacks, and expensive API or GraphQL queries. These attacks can resemble legitimate traffic. Relevant MITRE ATT&CK techniques include T1499.002 and T1499.003, depending on the behavior.

Vulnerability-Based Attacks

Vulnerability-based attacks exploit software flaws to crash services or exhaust resources, sometimes with relatively little traffic. Examples include regular expression denial of service (ReDoS) and HTTP/2 Rapid Reset (CVE-2023-44487). MITRE ATT&CK covers relevant application or service exhaustion behaviors under T1499.004. Patching vulnerabilities and secure application design are essential defenses alongside network-level protection.

DoS vs. DDoS

DoS and DDoS attacks share the same primary goal: making a service unavailable. The key difference is the number and distribution of systems used to generate attack.

A DDoS attack is not simply a larger DoS attack. Its distributed nature complicates attribution and mitigation because blocking one source may have little effect on the overall traffic. However, a single-source DoS attack can still cause a major outage if it exploits critical vulnerability or targets a resource with limited capacity.

Security Risks of Denial-of-Service Attacks

The immediate effect of a DoS attack is service disruption, but the broader impact can affect operations, finances, and security.

• Service downtime: Customers and employees may lose access to websites, applications, APIs, or internal services.
• Financial losses: Outages can interrupt sales, increase recovery costs, and lead to missed service-level commitments.
• Reputational damage: Repeated or prolonged disruption can reduce customer confidence in a service.
• Security distraction: Incident responders may be occupied with restoring availability while another attack takes place.
• Extortion: Attackers may threaten or conduct DDoS attacks to pressure an organization into making a payment.
• Cloud cost increases: Uncontrolled scaling and resource consumption can increase infrastructure or application costs.
• Operational disruption: Healthcare, financial, government, and other critical services may face significant consequences when essential systems become unavailable.

A denial-of-service attack does not inherently steal data. However, organizations should investigate related security signals during an outage rather than assume that availability is the only affected security objective.

How to Detect a DoS Attack

Detecting a denial-of-service attack requires monitoring both network traffic and application behavior. A sudden increase in traffic may indicate an attack, but legitimate demand for spikes, configuration errors, and infrastructure failures can produce similar symptoms.

Security and operations teams should look for indicators such as:

• Unusually slow response times or services that become unreachable.
• Sudden increases in requests, especially against a particular endpoint or API.
• Increased HTTP 429, 503, or 504 responses.
• Large numbers of incomplete or long-lived connections.
• Unexpected traffic surges on network services such as DNS or NTP.
• Rising CPU, memory, connection, or thread utilization.
• Unexpected autoscaling activity or cloud spending increases.
• Missing or delayed telemetry suggests monitoring systems are overloaded.

Teams should correlate network flow data, firewall and load balancer logs, application metrics, and infrastructure telemetry. Reviewing request patterns and backend resource usage can help distinguish volumetric attacks from low-volume application-layer or vulnerability-based attacks.

No single indicator proves that an attack is taking place. Detection is more reliable when traffic anomalies are assessed alongside service health, historical baselines, and evidence of resource exhaustion.

How to Prevent and Mitigate DoS Attacks

Effective DoS protection combines multiple controls to address different attack types.

• Network and Edge Protection: Use DDoS mitigation services, content delivery networks (CDNs), and traffic filtering to block malicious traffic before it reaches origin infrastructure. Disable unnecessary exposed services to reduce attack opportunities.
• Application and API Security: Apply rate limits, request throttling, connection timeouts, caching, and request-size limits. Enforce query-depth and query-cost limits for GraphQL and other resource-intensive APIs.
• Resilient Architecture: Use redundancy, queues, circuit breakers, graceful degradation, and DNS failover where appropriate. Set autoscaling limits to prevent attacks from driving infrastructure costs.
• Vulnerability Management: Identify and patch vulnerabilities in operating systems, network services, frameworks, and applications that could cause crashes or resource exhaustion.
• Continuous Monitoring and Incident Readiness: Monitor request rates, latency, error rates, connection counts, and resource usage. Maintain an incident response plan covering escalation, mitigation, communication, and recovery.

No single control, including IP blocklists, autoscaling, or a web application firewall (WAF), can prevent any DoS attack. Select defenses based on the attack vector and the service's architecture.

How to Respond to a DoS Attack

When a denial-of-service incident occurs, the response should restore availability while preserving enough evidence to understand the attack.

1. Confirm and scope the incident. Review network traffic, service health, error rates, and logs to distinguish an attack from a legitimate traffic surge or infrastructure fault.
2. Activate mitigation. Engage the DDoS provider or internet service provider as needed. Apply traffic filtering, rate limits, access control lists, and upstream scrubbing.
3. Protect critical functions. Throttle expensive endpoints, serve cached content, or temporarily restrict nonessential features where necessary.
4. Communicate clearly. Notify the relevant operations, security, business, and leadership teams. Update customer-facing status information according to the incident plan.
5. Check for related activity. Review authentication events, endpoint alerts, lateral movement indicators, and possible data exfiltration to determine whether the disruption is masking another attack.
6. Recover and review. Confirm that services have stabilized, preserve relevant evidence, and update detection rules, response procedures, and architecture based on lessons from the incident.

How Loginsoft Helps Reduce Denial of Service Risk

Network-edge DDoS mitigation is an important part of availability protection, but organizations also need to identify vulnerable software and exposed services that attackers may exploit.

Loginsoft's vulnerability intelligence and research capabilities help security teams assess relevant vulnerabilities and exploitation activity. Threat intelligence can provide context on malicious infrastructure and botnet campaigns, while external attack surface discovery helps identify exposed or misconfigured internet-facing services.

Combining these capabilities with network protection, application controls, and vulnerability management helps organizations prioritize remediation and reduce the opportunities attackers have to disrupt critical services.

Summary

A denial-of-service attack makes a website, application, server, or network unavailable by overwhelming resources or exploiting a vulnerability. DoS attacks generally originate from one source, while DDoS attacks use multiple distributed systems. Common types include volumetric, protocol-based, application-layer, and vulnerability-based attacks. Organizations can reduce the risk through layered network protection, application rate limits, resilient architecture, vulnerability management, continuous monitoring, and a tested incident response plan.

FAQs

Q1. What is a denial-of-service attack in cybersecurity?

A Denial-of-Service (DoS) attack is a cyberattack that overwhelms a computer system, network, or application with malicious traffic or resource-intensive requests, or exploits a vulnerability, making the service unavailable to legitimate users.

Q2. What is a real-life example of a denial-of-service attack?

A well-known example is the 2016 Dyn cyberattack, in which the Mirai botnet used compromised IoT devices, including routers and security cameras, to flood Dyn's DNS infrastructure with traffic. The attack disrupted access to popular services such as Twitter, Netflix, and Reddit for many users.

Q3. What is the difference between DoS and DDoS?

A DoS attack typically comes from one source, while a DDoS attack uses multiple distributed systems, often a botnet. DDoS attacks are generally harder to mitigate because malicious traffic originates from many sources.

Q4. Does a DoS attack steal data?

A DoS attack primarily targets availability rather than directly stealing data. However, attackers may use an outage to distract security teams while attempting a separate intrusion, so organizations should investigate other suspicious activity during the incident.

Q5. What are the main types of DoS attacks?

The main categories are volumetric attacks, protocol-based attacks, application-layer attacks, and vulnerability-based attacks. They target different resources, including bandwidth, connection state, application processing capacity, and software behavior.

Q6. How can an organization detect a DoS attack?

Common indicators include sudden traffic spikes, slow or unavailable services, increased error rates, excessive open connections, and unusually high CPU or memory use. Correlating network, application, and infrastructure telemetry helps teams distinguish attacks from normal demand changes.

Q7. How can a DoS attack be prevented?

Organizations can reduce risk through DDoS mitigation, rate limiting, caching, secure application design, resilient architecture, and timely patching. Monitoring and tested incident response procedures help teams detect attacks and restore service more quickly.

Q8. Is a denial of service attack illegal?

Unauthorized denial of service attacks are prohibited under laws in many jurisdictions. Applicable laws and penalties vary by country. Authorized stress testing should have documented permission, a defined scope, and appropriate safeguards.

Q9. How long does a DoS attack last?

The duration varies by attack technique, target, and mitigation capability. Some network-layer attacks end within minutes, while others continue for hours or longer. Organizations should monitor service recovery and confirm that the attack has subsided before closing an incident.

Q10. Can a software vulnerability cause a denial of service attack?

Yes. A vulnerability can allow a crafted request or input to exhaust CPU, memory, or other resources, or cause a service to crash. Patching vulnerable software and applying application-level protections are important even when network DDoS defenses are in place.

‍