Attack Distribution by Duration
In 2019, the average duration of DDoS attacks was registered at 52 minutes, an 18% increase from 2018. We noticed that the longest DDoS attack in 2019 lasted around 20 days, far longer than attacks detected in previous years.
In 2019, a DDoS attacks lasting less than 30 minutes accounted for 75%, approximate to the figure registered in 2018. The high proportion of short attacks signals that attackers are attaching more
and more importance to the attack cost and efficiency and are more inclined to overwhelm the target service with floods of traffic in a short time, getting users offline and causing high latency
and jitters. In addition, Botnet-as-a-Service (BaaS) and DDoS-as-a-Service (DDoS) have gained momentum for rapid development, which were also to blame for the prevalence of short attacks.
Thanks to their availability, platform users are able to launch massive attacks in a very short time as long as they are willing to pay a certain amount of money for a whole lot of mercenary attack resources4. In the long run, repeated burst attacks, which are under effective cost control, will greatly aggravate the quality of target services.
Temporal Distribution of Attack Activities Intraday
In one day from 0:00 to 24:00, busy hours (10:00–22:00) of services were the peak period of DDoS attacks, when 70% of attacks were spotted. The coincidence of busy hours of online service
access with the peak period of DDoS attacks indicates that attackers intended to maximize their attack effect and impact.
Temporal Distribution of Attack Activities Intraweek
In a week from Monday to Sunday, DDoS activities were evenly distributed in the seven days. An important reason behind this is that current network service providers usually serve customers 24/7. The odds of being attacked are the same for all the seven days.
To be continued.
