DDoS Mitigation
What is DDoS Mitigation?
DDoS MitigationDDoS mitigation is the set of techniques and services that absorb, filter, and re-route distributed denial-of-service attacks before they exhaust a target's network, infrastructure, or application capacity.
DDoS mitigation combats attacks at three layers: volumetric floods (UDP and amplification) measured in Gbps or Tbps, protocol attacks (SYN flood, slowloris) that exhaust connection state, and application-layer (L7) attacks against HTTP/HTTPS and APIs measured in requests per second. Modern providers — Cloudflare, Akamai, Google, AWS Shield, Imperva — terminate traffic at globally distributed anycast scrubbing centers, applying signature, behavioral, and rate-based filters plus JavaScript or proof-of-work challenges for L7. On-prem appliances and BGP flowspec / Remotely Triggered Black Hole (RTBH) routing remain important for ISPs and large enterprises.
Record incidents show why scale and automation matter. In February 2018 GitHub absorbed a 1.35 Tbps memcached reflection flood (UDP port 11211, amplification factor up to ~51,000) by rerouting traffic to Akamai Prolexic within minutes. In October 2023 AWS, Cloudflare, and Google jointly disclosed the HTTP/2 Rapid Reset technique (CVE-2023-44487, CVSS 7.5), which abuses stream multiplexing by opening and instantly cancelling requests; Google mitigated a record 398 million requests-per-second attack from a botnet of only ~20,000 machines. Because these attacks peak in seconds, effective mitigation depends on always-on scrubbing, telemetry baselines, tuned rate limits, runbooks, and pre-negotiated burst capacity — the defense must be in place before the attack starts, not spun up during it.
flowchart LR
A[Botnet / reflectors] -->|attack traffic| B{Anycast edge}
C[Legitimate users] -->|clean traffic| B
B --> D[Volumetric filter: rate & signature]
D --> E[Protocol checks: SYN cookies, state limits]
E --> F[L7 defense: JS / PoW challenge, WAF]
F -->|scrubbed| G[Origin server]
D -. drop / blackhole .-> X[(Discarded)]
F -. block bots .-> X● Examples
- 01
An anycast scrubbing center absorbs a 2 Tbps UDP-amplification flood at the network edge.
- 02
Rate-limiting and JS challenges blunt an L7 HTTP flood against a checkout endpoint.
● Frequently asked questions
What is DDoS Mitigation?
DDoS mitigation is the set of techniques and services that absorb, filter, and re-route distributed denial-of-service attacks before they exhaust a target's network, infrastructure, or application capacity. It belongs to the Network Security category of cybersecurity.
What does DDoS Mitigation mean?
DDoS mitigation is the set of techniques and services that absorb, filter, and re-route distributed denial-of-service attacks before they exhaust a target's network, infrastructure, or application capacity.
How do you defend against DDoS Mitigation?
Defences for DDoS Mitigation typically combine technical controls and operational practices, as detailed in the full definition above.
What are other names for DDoS Mitigation?
Common alternative names include: DDoS protection, DDoS scrubbing.