How it typically works?
- Targeting: attacker identifies expensive operations or endpoints such as search, login, or report generation.
- Crafting: attacker generates requests that mimic legitimate users but at volumes or patterns that exhaust backend resources.
- Execution: bots or scripts submit the requests, sometimes using distributed agents to avoid IP based blocking.
- Persistence: the attack may adapt request patterns to evade simple rate limiting and maintain pressure.
Common techniques & variants
- HTTP flood: send large numbers of valid HTTP requests to consume server cycles, often targeting search or login endpoints.
- Slow request attacks: hold connections open using partial requests to exhaust web server worker threads, for example slow read techniques.
- API abuse: target API endpoints that trigger heavy database or backend processing.
- Login or session exhaustion: repeated authentication attempts or session creation to overload identity systems.
- Resource heavy payloads: exploit endpoints that require intensive computation or database joins to maximize impact with fewer requests.
Impact
Application layer attacks can degrade user experience, cause server crashes or increase backend costs as autoscaling provisions extra instances. From a SecOps perspective these attacks are harder to detect because they imitate normal behavior. Defenders need layered visibility into request patterns, user agent signatures, and backend telemetry to separate legitimate spikes from malicious activity. Effective mitigations include request profiling, behavior based rate limiting, and application level caches to reduce computational cost for repeated requests.
Further reading
- OWASP: Denial of service. Read more
- Cloudflare: Layer seven attacks overview. Read more
- Akamai: Application layer DDoS mitigation. Read more
- Imperva: HTTP flood analysis. Read more