What is a Layer 7 DDoS attack?

Back to learning

A Layer 7 DDoS attack targets the "Application Layer" of the OSI model. Unlike other types of DDoS attacks that flood network layers with traffic, a Layer 7 attack focuses on specific functions or features of a web application or service.

Quick Answer: What Is Layer 7 DDoS Protection?

Layer 7 DDoS protection stops request floods that target the application itself: login, search, checkout, API, account, and other expensive dynamic routes. Good mitigation combines traffic baselines, anomaly detection, bot signals, WAF and API policy, caching, and route-aware rate limits before the attack consumes origin resources.

Layer 7 attacks are more sophisticated as they target the application layer, which is the closest layer to the end user. While other DDoS attacks like volumetric or protocol attacks aim to overwhelm bandwidth or exploit network vulnerabilities, Layer 7 attacks mimic human-like interaction with the application, making them harder to detect.

Common targets include web pages, API endpoints, and databases that are part of web applications or online services.

How Does a Layer 7 Attack Work?

These attacks often involve repeated requests to a specific aspect of an application, like a search function, login page, or API endpoint. The goal is to exhaust server resources, such as CPU or memory, to render the application unresponsive or slow.

What are Some Types of Layer 7 Attacks?

1. HTTP GET Attacks: Overwhelm a server by sending numerous HTTP GET requests.
2. HTTP POST Attacks: Send large or complex POST requests to drain server resources.
3. Slowloris Attacks: Keep many connections to the target web server open and hold them open as long as possible.

How Can You Detect a Layer 7 Attack?

• Rate-based Detection: Monitors the request rate and triggers alerts when thresholds are crossed.
• Behavioral Analysis: Uses machine learning algorithms to identify abnormal traffic patterns.
• Traffic Profiling: Examines incoming traffic to distinguish between human and bot-generated requests.

How Can You Mitigate a Layer 7 Attack?

Effective Layer 7 DDoS mitigation combines request limits, caching, WAF rules, bot signals, anomaly detection, and challenges so attackers cannot drain application resources through one weak control. Peakhour's Layer 7 DDoS protection page shows how those controls fit together in the request path.

1. Rate Limiting: Restrict the number of requests from a single IP address, account, route, fingerprint, or other request signal.
2. Caching: Use caching mechanisms for static and cacheable dynamic resources to reduce server load.
3. Challenge-Response Tests: Employ CAPTCHA or JavaScript challenges to distinguish human users from bots.
4. Web Application Firewall (WAF): Configure a WAF to monitor, filter, and block malicious HTTP traffic.
5. Load Balancing: Distribute incoming traffic among multiple servers to prevent a single point of failure.