Menu
What is The best way of preventing the distributed denial-of-service and denial-of-service attacks in ASP.Net core?
How to handle protection in the request pipeline or separate middleware?
837
There are two primary means of detecting DDoS attacks: in-line examination of all packets and out-of-band detection via traffic flow record analysis. Either approach can be deployed on-premises or via cloud services.
You cannot trace a DDoS attack and identify who is behind it without studying the attack's architecture. As you now know, the basic anatomy of any DDoS attack is Attacker > Botnet > Victim. A botnet is a network of instruction-following bots.
Network-based IPS devices also use protocol anomaly-based detection, which is not effective in detecting and stopping DDoS attacks. That is because this method of detection does not allow IPS devices to analyze traffic simultaneously across multiple links.
Apart from the obvious mitigation you can (and should) implement before the requests reach your application (e.g. in the web server itself), there are a number of ways to implement so-called request throttling in your pipeline.
Luckily, you don't need to re-invent the wheel. There are myriad NuGet packages and open-source projects that address this and that you can learn from.
The essence of it is, that you intercept the incoming requests and persist things like request URI and IP while cross-checking a request-per-time-unit limit and imposing a cool-down period when needed.
Needless to say, you'd put this as far up in your application's request pipeline as possible.
The following isn't a software recommendation but more of an example to learn about how this sort of middleware can be built. It really isn't that hard to grasp the basics of the process from it.
53
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
