DoS Attack Mitigation

From Building Secure and Reliable Systems Ch 10 — anycast, scrubbing centers, rate limiting tiers, and the architectural choices that separate services that survive volumetric attacks from those that do not.

Overview

DoS is a reliability problem

*Building Secure and Reliable Systems* Chapter 10, Mitigating Denial-of-Service Attacks, treats DoS mitigation as a reliability engineering problem, not purely a security one. A service that goes down during a volumetric attack has failed its SLO, and the cause is irrelevant to users who cannot reach it.

> [!IMPORTANT] "The most resilient services are not those that detect and block all attacks, but those that are architected to function under abnormal traffic conditions."

Three attack types, three mitigation layers

Volumetric — Floods the network link with Gbps or Tbps — Upstream, at the ISP or CDN, before traffic reaches the data center — Absorb and scrub at the edge
Protocol — Exploits protocol handling: SYN floods, fragmented packets — Load balancer or firewall — SYN cookies, connection table limits, protocol validation
Application-layer — Valid HTTP requests at high rate against expensive endpoints — Application — Rate limiting, CAPTCHA, admission control

Three architectural properties for resilience

Anycast routing — One IP announced from many locations, so attack traffic spreads across all of them and per-location impact drops
Scrubbing capacity — Scrubbing centers redirect attack traffic, strip malicious packets and forward clean traffic
Over-provisioning — At 2x expected peak capacity, a 100% traffic spike is absorbed without degrading, whether it is an attack or organic

Key concepts

Anycast: A routing technique where the same IP address is announced from multiple geographic locations. Traffic is routed to the nearest node, distributing attack volume across all locations rather than concentrating it at one.
Scrubbing center: A network facility that receives redirected (possibly attack) traffic, filters malicious packets using deep packet inspection and rate-limiting rules, and forwards clean traffic to the origin.
BGP blackholing: Advertising a route with a null next-hop via BGP, causing ISP routers to drop all traffic destined for a specific IP prefix. Nuclear option for volumetric attacks — effective but takes the service offline for legitimate users too.
SYN cookie: A TCP connection mechanism that encodes connection state in the initial SYN-ACK sequence number rather than allocating a connection table entry. Prevents SYN flood attacks from exhausting connection table memory.
Rate limiting tiers: Multiple layers of rate limiting at different granularities: IP-level (prevent volumetric from single source), user/API key (prevent application-layer abuse), endpoint-level (protect expensive operations).

When to use it

"How do you protect your service against a DDoS attack?" — walk through the layer model
Designing a public-facing API that must remain available during attack traffic
"What is the difference between a volumetric attack and an application-layer attack?"
Justifying CDN or anycast infrastructure investment for a reliability budget

Interview questions

How do you architect a public API service to remain available during a 100 Gbps volumetric DDoS attack?