Denial of Service (DoS/DDoS) in Cybersecurity - Step-by-Step Execution

Concept Flow - Denial of Service (DoS/DDoS)

Attacker sends many requests

↓

Target server receives requests

↓

Server tries to respond

↓

Server resources get overloaded

↓

Legitimate users cannot access service

↓

Service disruption

The attacker floods a server with excessive requests, causing it to overload and stop serving real users.

Execution Sample

Cybersecurity

Attacker -> send flood of requests
Server -> receive requests
Server -> process requests
Server -> resources overload
Users -> cannot access service

Shows the step-by-step flow of a DoS attack causing service disruption.

Analysis Table

Step	Action	Effect on Server	Effect on Users
1	Attacker sends many requests	Server starts receiving high traffic	Users can access normally
2	Server processes requests	Server CPU and memory usage increase	Users still can access
3	Requests flood continues	Server resources near limit	Users experience slow responses
4	Server resources overloaded	Server cannot handle new requests	Users cannot access service
5	Service disrupted	Server becomes unresponsive or crashes	Users denied access

💡 Server resources fully overloaded, legitimate user requests blocked, causing denial of service

State Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	Final
Server CPU Usage	Low	Medium	High	Maxed Out	Overloaded
Server Memory Usage	Low	Medium	High	Maxed Out	Overloaded
User Access	Normal	Normal	Slow	Blocked	Denied

Key Insights - 3 Insights

Why does the server stop responding even though it tries to process requests?

Because the server's CPU and memory reach their maximum capacity (see execution_table step 4), it cannot handle any more requests, causing it to become unresponsive.

Why do legitimate users experience slow responses before being completely blocked?

As the server resources get heavily used (execution_table step 3), it slows down processing all requests, affecting legitimate users before fully denying access.

Is the attack successful if the server never crashes but users cannot access the service?

Yes, the goal of DoS is to deny service, so even if the server stays running but blocks users (execution_table step 5), the attack succeeds.

Visual Quiz - 3 Questions

Look at the execution_table at which step does the server start to block legitimate users?

A Step 2

B Step 3

C Step 4

D Step 5

💡 Hint

Check the 'Effect on Users' column in execution_table rows for when users start being blocked.

According to variable_tracker, what happens to server CPU usage after step 3?

A It becomes high

B It stays medium

C It decreases

D It is maxed out

💡 Hint

Look at the 'Server CPU Usage' row in variable_tracker after step 3.

If the attacker sends fewer requests, how would the 'User Access' variable change in variable_tracker?

A It would immediately be 'Denied'

B It would remain 'Normal' longer

C It would become 'Blocked' earlier

D It would not change at all

💡 Hint

Consider how fewer requests affect server load and user access in variable_tracker.

Concept Snapshot

Denial of Service (DoS) attacks flood a server with excessive requests.
This overloads server resources like CPU and memory.
Legitimate users experience slow or no access.
Distributed DoS (DDoS) uses many sources to amplify the attack.
Goal: disrupt service availability to real users.

Full Transcript

Denial of Service (DoS) attacks happen when an attacker sends a huge number of requests to a server. The server tries to handle all these requests, which uses up its CPU and memory. As the server gets overloaded, it slows down and eventually cannot respond to real users. This causes legitimate users to lose access to the service. In a Distributed Denial of Service (DDoS), many attackers or devices send requests together, making the attack stronger. The main idea is to make the service unavailable to real users by overwhelming the server.

Practice

1. What is the main goal of a Denial of Service (DoS) attack?

easy

A. To install software updates

B. To steal user passwords

C. To make a service unavailable by overwhelming it

D. To improve website speed

Solution

1. Step 1: Understand the definition of DoS

   A Denial of Service attack aims to stop users from accessing a service by overwhelming it with traffic or requests.

2. Step 2: Compare options with the definition

   Only To make a service unavailable by overwhelming it matches this goal. Other options describe unrelated actions.

3. Final Answer:

   To make a service unavailable by overwhelming it -> Option C

4. Quick Check:

   DoS = Overwhelm service [OK]

Hint: DoS means stopping access by overload [OK]

Common Mistakes:

• Confusing DoS with stealing data
• Thinking DoS improves service
• Mixing DoS with software updates

2. Which of the following best describes a Distributed Denial of Service (DDoS) attack?

easy

A. An attack from a single computer targeting a service

B. An attack using many computers to overwhelm a service

C. A method to speed up network traffic

D. A way to encrypt data for security

Solution

1. Step 1: Define DDoS attack

   DDoS attacks use many computers working together to flood a service with traffic, making it unavailable.

2. Step 2: Match options to definition

   An attack using many computers to overwhelm a service correctly describes this. An attack from a single computer targeting a service describes a single source attack (DoS), others are unrelated.

3. Final Answer:

   An attack using many computers to overwhelm a service -> Option B

4. Quick Check:

   DDoS = Many computers attack [OK]

Hint: DDoS means many computers attack together [OK]

Common Mistakes:

• Confusing DDoS with single computer attacks
• Thinking DDoS speeds up networks
• Mixing DDoS with encryption

3. Consider this scenario: A website receives a sudden flood of traffic from thousands of different IP addresses, causing it to crash. What type of attack is this?

medium

A. Distributed Denial of Service (DDoS) attack

B. Phishing attack

C. Malware infection

D. SQL Injection

Solution

1. Step 1: Analyze the traffic source

   The traffic comes from thousands of different IP addresses, indicating multiple sources.

2. Step 2: Identify attack type by symptoms

   Multiple sources flooding a website causing crash matches a DDoS attack, not phishing, malware, or SQL injection.

3. Final Answer:

   Distributed Denial of Service (DDoS) attack -> Option A

4. Quick Check:

   Many IPs flooding = DDoS [OK]

Hint: Many IPs flooding = DDoS attack [OK]

Common Mistakes:

• Confusing DDoS with phishing
• Thinking malware causes traffic flood
• Mixing SQL injection with traffic overload

4. A network administrator notices that a server is slow and unresponsive. They suspect a DoS attack. Which of the following is the best first step to confirm this?

medium

A. Change the server's IP address

B. Restart the server immediately

C. Update the server software

D. Check server logs for unusually high traffic

Solution

1. Step 1: Identify symptoms of DoS

   Slow and unresponsive server can be caused by high traffic from a DoS attack.

2. Step 2: Confirm by checking logs

   Checking server logs for unusually high traffic helps confirm if a DoS attack is happening before taking action.

3. Final Answer:

   Check server logs for unusually high traffic -> Option D

4. Quick Check:

   High traffic logs = Confirm DoS [OK]

Hint: Check logs first to confirm DoS attack [OK]

Common Mistakes:

• Restarting server without diagnosis
• Changing IP without evidence
• Updating software before confirming attack

5. Which of the following is the most effective way to protect a website from a Distributed Denial of Service (DDoS) attack?

hard

A. Use a firewall and traffic filtering services

B. Disable all website features

C. Change the website's domain name frequently

D. Only allow access from one IP address

Solution

1. Step 1: Understand DDoS protection methods

   Firewalls and traffic filtering services can detect and block malicious traffic from many sources.

2. Step 2: Evaluate options for practicality

   Disabling features or changing domain names does not stop attacks. Allowing one IP is impractical for public sites.

3. Final Answer:

   Use a firewall and traffic filtering services -> Option A

4. Quick Check:

   Firewall + filtering = Best DDoS defense [OK]

Hint: Firewalls and filters block bad traffic [OK]

Common Mistakes:

• Thinking disabling features stops attacks
• Believing domain changes prevent DDoS
• Restricting access too narrowly for public sites