DDoS Attack

Layer 7 is the topmost layer of the OSI model and is responsible for delivering services to end users. Essentially, it’s where web pages are generated in response to HTTP requests. Attacks at this layer aim to exhaust the server's resources by imitating legitimate user behaviour, making them particularly difficult to detect. A common example is the HTTP Flood, where the attacker sends a massive volume of GET or POST requests, similar to thousands of users refreshing a webpage at the same time. These floods can range from straightforward, repeated requests to more sophisticated versions that use randomized user agents, referrer URLs, and rotating IP addresses to evade detection systems. 

These attacks, also known as state exhaustion attacks, exploit the underlying network and transport protocols (Layers 3 and 4 of the OSI model) to deplete critical infrastructure resources like firewalls, load balancers, and application servers. One well-known example is the SYN Flood, which takes advantage of the TCP handshake process. In this scenario, the attacker sends a flood of SYN packets with spoofed IP addresses. Each packet prompts the server to allocate resources for a connection that never completes; much like a warehouse worker endlessly preparing boxes for fake orders. Other examples include Ping of Death and Smurf attacks, both of which disrupt services by manipulating standard networking behaviors in abnormal volumes or formats. 

Unlike protocol and application layer attacks, volumetric attacks focus on consuming all available bandwidth between the target and the broader internet. They aim to create sheer volume rather than exploit specific vulnerabilities. One notorious method is DNS Amplification, where small queries are sent to misconfigured DNS servers with a spoofed IP address: that of the target. The servers respond with much larger replies directed at the victim, multiplying the original request size and overwhelming the target. Other volumetric techniques include UDP Floods and NTP Amplification, both of which similarly leverage open services to generate massive traffic spikes. Many of these attacks are launched using botnets composed of compromised IoT devices, such as the infamous Mirai botnet, which harnessed millions of unsecured gadgets to stage some of the largest DDoS attacks ever recorded.