Pierluigi Paganini October 18, 2013

Arbor Networks has published a quarterly report based on data pulled from ATLAS which includes new insight into DDoS attack trends having worrying characteristics.

Arbor Networks has issued the report on global DDoS attack trends for the first three quarters of 2013, the report revealed that this kind of attack still represents a serious menace for IT security communities. The document provides an interesting overview into Internet traffic patterns and threat evolution. The data show a constant growth in the number or attacks and related efficiency, the experts observed a meaningful increase (32%) for malicious traffic, the IPv4 traffic reached  69Tbps of peak, up from 47Tbps in registered in  Q2.

  The 2013 Q3 report also highlighted a concerning increase in the Average attack size, the average size of the attacks expressed in bits-per-second (BPS) for the last quarter was included in the 3-3.5 Gbps range.  The graph below shows the average monthly Mbps of attacks and peak Gbps of the attacks, both picture confirm the significant growth of the cyber threat.

  The average attack sizes on monthly base touched 3Gb/sec, the experts remarked that despite the attack volume seem to be taking up across the board when it comes to bits-per-second, the situation is inverse if it is considered in packets-per-second. The DDoS Q3 2013 report states that the largest DDoS attack size had a peak at 191Gbps and occurred in August 2013, this data is considered concerning because it has broken through the psychological threshold of alert estimated on 100Gbps. Another element of interest in the data proposed by DDoS Q3 2013 are the information on the magnitude of single events, ATLAS has monitored a superior number of attacks over 20Gbps respect previous year. Following key findings for proposed by Atlas on DDoS attacks:

• 54% of attacks so far this year are over 1Gb/sec, up from 33% in 2012
• 37% of attacks so far this year are in the 2 – 10 Gb/sec range, up from 15% last year
• 44% growth in proportion of attacks over 10Gb/sec, to 4% of all attacks
• More than 350% growth in the number of attacks monitored at over 20Gb/sec so far this year, as compared to the whole of 2012
• For 2013 an average DDoS attack now stands at 2.64Gb/sec, up 78% from 2012
• 87% of all attacks monitored so far this year last less than one hour
• Largest monitored and verified attack size increases significantly to 191Gb/sec.

I suggest the reader to read the full report to better understand the evolution of the DDoS cyber threat.

Pierluigi Paganini

(Security Affairs –  Atlas, DDoS)