Security researchers said they fended off a distributed denial-of-service (DDoS) attack in January of more than 500 million packets per second, which might constitute the largest of its kind ever publicly disclosed.

In a blog post, Imperva said the incident involved a syn flood, otherwise known as a series of Transmission Control Protocol (TCP) connection requests, which overloaded the capabilities of the machine or network in question. This was followed by an even larger syn flood containing packets of between 800 and 900 bytes.

Though the identities of those responsible aren’t known, researchers said they believe the DDoS attack was launched by two people who wrote tools that spoofed and randomized the traffic involved.

Measuring DDoS Attack Intensity

While the attack was mitigated and the customer was not mentioned by name, the researchers suggested that the incident offered a case for rethinking the way DDoS attacks are measured. Network bandwidth that reached 1.35 Tbps, for example, led several experts to classify an attack on Github as the largest-ever DDoS incident in 2018.

Given that mitigation requires inspecting every single packet head, however, the researchers argued that the volume of packets per second, not their size, becomes the bigger issue because of the network resources required. The Github incident, for example, involved a relatively low rate of 1.26 million packets per second and is something that could therefore be potentially contained by traffic filtering or an appliance, the researchers said.

The incident in January, meanwhile, put researchers on alert because packets were malformed as their parameters were randomized. This was likely a mistake caused by the attackers’ tools that were supposed to replicate real operating systems.

DDoS Attack Mitigation in the Cloud

As more organizations shift their IT infrastructure from on-premises servers to those hosted in a private, public or hybrid cloud, the potential impact of DDoS attacks could be even greater.

In fact, IBM experts pointed out that volume-based, protocol and application-layer attacks are all among the potential DDoS variants. Fortunately, these can be mitigated through a number of different means, from DDoS traffic scrubbing to the use of next-generation firewalls or content delivery networks.