| Distributed denial of service (DDoS) attacks have been a nightmare for enterprise operations, availability, and security. After the emergence of modern computing paradigms like cloud computing, these attacks saw major changes in scale, methods, aims, and targets. The advantages provided by cloud computing are available to both victims and the attackers. This has made the DDoS arms race interesting and quite complex.1 In 2004, the peak attack bandwidth was just 8 gigabits per second (Gbps). However, according to the report by Arbor Networks, there were much heavier DDoS attacks with attack bandwidths of more than 500 Gbps in 2015.2 The target services of DDoS attacks lie in each sector infl uenced by IT infrastructure, whether its government, banking, or media industry. As reported by Arbor Networks, the percentage of attacks targeting cloud-based services is growing each year. Over 33 percent of reported DDoS attacks in 2015 targeted cloud services, which makes the cloud a major attack target. Motivation for the DDoS attacks range from extortion, demonstration of attack capabilities, and hacktivism to business rivalry. It is interesting to note the rise of DDoS-attack-for-hire payment-based services, also known as booters or stressers, that attack a target via the planting of attack guns (botnets).3 With the arrival of these methods, the attack frequencies to victim organizations have increased considerably in recent few years. DDoS attacks may last between a few seconds to even weeks in a few cases, which multiplies the economic and business losses multifold. In particular, the attack duration has enormous impact on the services running on the cloud due to the on-demand utility computing model of the cloud. Financial losses due to DDoS attacks have multiple components or symptoms, few of which are visible during the attack. However, the remaining part of the losses are visible only after the attack disappears. Most of these losses are diffi cult to measure, including the long-term reputation and ensuing business losses. There are recent and much talked about massive DDoS attacks on cloud services and cloud service providers that have shaped the socalled battlefi elds of the cyberattacks. The fi rst popular attack occurred around Christmas 2014 on Sony and Microsoft gaming servers using cloud-based services related to PlayStation and Xbox, respectively. Similarly, there was an attack on cloud service provider Rackspace that was a DNS DDoS attack and lasted more than 11 h. Another attack in the third quarter of 2014 involved a combination of hacking and DDoS attack on Amazon EC2 cloud services.4 A more recent attack transpired in late 2015 on cloud-hosting provider Linode and lasted for more than a week. These attacks made the entire cyber security research community consider the scale and strength of these attacks. This introspection and reevaluation of the mitigation methods substantiates the attackers’ target shift toward cloud services. |