The document discusses a report from Netscout on Distributed Denial of Service (DDoS) attacks in the first half of 2020. It finds that the number of attacks increased 15% compared to 2019, with a 25% rise during COVID-19 lockdowns. Attack sizes also grew, with the largest reaching 1.12 terabits per second. The report examines attack trends by type, target industry, and country. It recommends using intelligent, automated hybrid DDoS protection combining on-premise and cloud-based solutions with continuous threat intelligence.

1. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. | PUBLIC 1
DDoS Attacks in 2020 &
Best Practices in Defense
Tom Bienkowski
Director Product Marketing
Richard Hummel
Manager, Threat Response

2. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. | PUBLIC 2
DDoS Attacks – 1st Half 2020
Number
Size
Types
Targets
Protection

3. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. | PUBLIC 3
NETSCOUT Cyber Threat Horizon
https://www.netscout.com/horizon

4. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. | PUBLIC 4
DDoS Attacks – 1st Half 2020
Number
Size
Types
Targets
Protection

5. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. | PUBLIC 5
Number of DDoS Attacks
Worldwide, Six-Month Review 2020 vs. 2019
▪ Number of attacks 4.83M, 15% from 2019
Number of DDoS Attacks (Millions)
2019 2020
Q1 2.04 2.21
Q2 2.17 2.62
Total 4.21 4.83

6. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. | PUBLIC 6
DDoS Attacks Increased During COVID-19
Lockdown
Note: July
was 828k…Is
this a new
normal?

7. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. | PUBLIC 7
DDoS Attacks – 1st Half 2020
Number
Size
Types
Targets
Protection

8. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. | PUBLIC 8
Size of DDoS Attacks
Worldwide Six-Month Review 2020 vs. 2019
▪ Largest attack
1.12Tbps,
77% bigger than
largest in 2019
Peak Volume DDoS Attacks (Gbps)
2019 2020
Q1 510 488
Q2 634 1120

9. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. | PUBLIC 9
Size of DDoS Attacks
Worldwide Six-Month Review 2020 vs. 2019
▪ Largest attack
1.12Tbps,
77% bigger than
largest in 2019
Peak Volume DDoS Attacks (Gbps)
2019 2020
Q1 510 488
Q2 634 1120
Peak Speed DDoS Attacks (Mpps)
2019 2020
Q1 358 392
Q2 364 407
▪ Largest attack
407 Mpps,
12% bigger than
largest in 2019

10. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. | PUBLIC 10
Size of DDoS Attacks
Worldwide Six-Month Review 2020 vs. 2019
Vast majority of DDoS attacks are small-sized & short-lived.

11. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. | PUBLIC 11
DDoS Attacks – 1st Half 2020
Number
Size
Types
Targets
Protection

12. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. | PUBLIC 12
Types of DDoS Attacks
The Internet
BotNet
Your ISP
Firewall/VPN
Your Data Center
Legitimate Traffic
State-Exhaustion Attacks
◦ Designed to target stateful devices (Load
balancer, firewall, VPN, IPS)
Volumetric Attacks
◦ Large (up to 1.2 Tbps)
◦ Designed to saturate links
Application Layer Attacks
◦ Low and slow, stealth attacks
◦ Crashes application servers
The modern-day DDoS attack is complex as it can
dynamically uses 15+ vectors

13. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. | PUBLIC 13
Different DDoS Attack Vectors

14. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. | PUBLIC 14
Real World Examples of Multi-Vector DDoS Attacks
StartDate StopDate
Volume
(Gbps)
Speed
(Mpps) Region Vectors
Small-sized + short-lived + multi vector = Increase in Complexity

15. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. | PUBLIC 15
DDoS Attacks – 1st Half 2020
Number
Size
Types
Targets
Protection

16. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. | PUBLIC 16
Notable DDoS Attacks Per Industry Sector
Worldwide, Six-Month Review 2020 vs. 2019
Industry #Attacks Max
Volume
Max
Speed
Avg
Duration
Telecommunications -18% -23% +13% -48%
Data Processing ,
Hosting and Related
+21% -20% -57% -15%
Nonstore Retailers +43% -44% +48% +8%
Hospitals +25% +255% +15% -3%

17. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. | PUBLIC 17
Notable DDoS Attacks Per Country
Worldwide, Six-Month Review 2020 vs. 2019
Country #Attacks Max
Volume/
Max
Speed
Avg
Duration
United States +13% +8% +23% -21%
United Kingdom +62% +39% -60% -56%
Germany +233% +266% -36% -47%
Canada -25% -42% -51% +31%
▪ The average volume and speed of attack traffic on a per second basis flowing in/out of these
countries:
➢ US: 278.02 Gbps, 59.98 Mpps
➢ UK: 32.50 Gbps, 5.56 Mpps
➢ Germany: 136.67 Gbps, 22.89 Mpps

18. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. | PUBLIC 18
Worldwide DDoS Attacks
Worldwide, Six-Month Review 2020 vs. 2019
DDoS Attack Frequency:
➢ Number of attacks 4.83M, 15% from 2019
➢ 25% during COVID-19 Pandemic lockdown
DDoS Attack Size:
➢ Largest attack 1.12Tbps, 77% bigger than largest in 2019
➢ However, vast majority of attacks are small, 74% attacks <1Gbps
DDoS Attack Duration:
➢ Longest duration attack was 7 days
➢ However vast majority of attacks, 92% attacks last <1Hour
Summary: DDoS Attacks Increase 25% in Frequency and
Complexity During COVID-19 Pandemic
DDoS Attack Vectors:
➢ 15+ vector attacks becoming more common.
1H 2020
Looks for more information
when we release the next
report at end of September!

19. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. | PUBLIC 19
DDoS Attacks – 1st Half 2020
Number
Size
Types
Targets
Protection

20. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. | PUBLIC 20
The modern-day DDoS attack is complex as it can
dynamically uses 15+ vectors
Types of DDoS Attacks
The Internet
BotNet
Your ISP
Firewall/VPN
Your Data Center
Legitimate Traffic
State-Exhaustion Attacks
◦ Designed to target stateful devices (Load
balancer, firewall, VPN, IPS)
Volumetric Attacks
◦ Large (up to 1.2 Tbps)
◦ Designed to saturate links
Application Layer Attacks
◦ Low and slow, stealth attacks
◦ Crashes application servers

21. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. | PUBLIC 21
Stopping The Modern Day DDoS Attack Requires
Intelligently Automated, Hybrid Protection
4 Backed by continuous
threat intelligence.
Your Data Centers/
Internal Networks
The Internet
ISP Network
Scrubbing Center
Volumetric Attack
Automatically stop
large attacks In-Cloud.
3
Automatic, intelligent communication
between on-prem and cloud-based
protection to address dynamic, multi-vector
attacks.
2
State Exhaustion & Application Attack
Automatically stop state exhaustion and application
layer DDoS attacks on premises, in front of stateful
devices (e.g. firewall/VPN concentrator) and
application servers.
1
DDoS
Protection
The Internet
Firewall/VPN Application Servers
A Recommended Industry Best Practice:

22. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. | PUBLIC 22
NETSCOUT Arbor Smart DDoS Protection Solution
Your Data Centers/
Internal Networks
The Internet
ISP Network
State Exhaustion & Application Attack
AED is an on-premise, stateless, product that can
stop all types of inbound DDoS attacks and outbound
communication from compromised internal devices -
providing a First and Last Line of Defense
1
AED’s Cloud Signaling can intelligently communicate
with a cloud-based mitigation service (e.g. your ISP
or Arbor Cloud) to stop the large attacks.
2
The Internet
Firewall/VPN Application Servers
Arbor Edge
Defense
(AED)
Volumetric Attack
Mitigate large attacks with
ISP or Arbor Cloud which
has 11 worldwide scrubbing
centers with over 14 Tbps of
mitigation capacity.
3
Arbor Cloud
4
Backed by continuous Threat
Intelligence for ASERT/ATLAS and can
be a fully managed services.

23. COPYRIGHT © 2018 NETSCOUT SYSTEMS, INC. | PUBLIC 23
THREAT INTELLIGENCE REPORT
VISIT LINK FOR LATEST REPORT
https://www.netscout.com/threatreport