{'fraction_non_alphanumeric': 0.02268178785857238, 'fraction_numerical': 0.00266844563042028, 'mean_word_length': 5.147540983606557, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Breaking the DDoS Attack Chain

Department of Defense (DoD) communications and data networks continue to be targets for adversaries to deny operational use of those networks. Distributed Denial of Service (DDoS) is one such attack strategy that has proven to be an effective method of denying service to military, political, infrastructure, and economic targets. The introduction of botnets as zombies, or computers under control of another entity unbeknownst to the owner, which can be controlled with minimal effort by an obfuscated attacker to degrade or deny usage of networks through overloading capacity, has proven successful time and again. As some network security firms have reported, the United States is a prime target for adversaries, and it is far from impervious to cyber attacks. In their 2011 paper, Hutchins, Cloppert, and Amin discuss the concept of an attacker kill chain for phases of intrusions into networks but do not address other asymmetric cyber threats such as DDoS. In order to fill this gap, this paper provides a survey of the DDoS landscape and examines the application of “kill chain” concepts to the DDoS threat. Leveraging the concepts of detect, deny, disrupt, degrade, deceive, and destroy, the paper explores ways that this chain may be disrupted. Lastly, an overview of the critical and emerging DDoS threats is provided, and considerations are offered for additional technology and research that have potential to significantly reduce the current DDoS threat.