01The map: what each attack goes after
availability Denial of service
Exhausts bandwidth, connection state, or CPU so legitimate users cannot be served. Needs no break-in at all.
integrity Malware propagation
Gets code running on one host, then uses network services, shared credentials, or files to reach the next.
confidentiality Phishing
Attacks the human: tricks someone into handing over credentials, approving a payment, or running a payload.
- MITRE ATT&CK — map each stage to real-world techniques
- Verizon Data Breach Investigations Report — which vectors dominate each year
02Distributed denial of service
A denial-of-service attack wins by making a target spend more resources than it has. "Distributed" means the traffic comes from thousands of sources at once, so blocking one address does nothing and the aggregate can exceed any single link's capacity.
The SYN flood
A TCP server allocates state when it receives a SYN and waits for the final ACK. Send millions of SYNs from spoofed addresses and the half-open table fills, so real clients are refused. SYN cookies defend by encoding the state into the server's sequence number and allocating nothing until a valid ACK returns.
- Cloudflare Learning Paths — What is a DDoS attack?
- RFC 4987 — TCP SYN flooding attacks and common mitigations
- ATT&CK T1498 — Network Denial of Service
- Mirkovic, J. & Reiher, P. (2004). A taxonomy of DDoS attack and DDoS defense mechanisms. ACM SIGCOMM CCR, 34(2).
- Moore, D. et al. (2006). Inferring Internet denial-of-service activity. ACM TOCS, 24(2).
03Reflection and amplification
UDP has no handshake, so the source address is not verified. An attacker sends small requests to public servers with the victim's address forged as the source. The servers send their much larger replies to the victim. The attacker's bandwidth is multiplied, and the traffic arrives from legitimate servers that cannot simply be blocked.
The systemic fix is source address validation (BCP 38): every network drops outgoing packets whose source address is not one of its own. Every network that does this removes itself as a launch pad, but it only works if nearly everyone participates, which is why amplification persists.
- RFC 2827 (BCP 38) — Network ingress filtering
- MANRS network operator guide — routing security and anti-spoofing norms
- Shadowserver — scans for and reports open amplifiers
- Paxson, V. (2001). An analysis of using reflectors for distributed denial-of-service attacks. ACM SIGCOMM CCR, 31(3).
- Rossow, C. (2014). Amplification hell: revisiting network protocols for DDoS abuse. NDSS.
04Botnets
A botnet is a fleet of compromised machines that obey a remote operator. The same infrastructure rents out DDoS, sends spam and phishing, mines cryptocurrency, proxies criminal traffic, and stuffs stolen credentials into login pages.
IoT devices made botnets cheap: cameras and routers with default passwords, no updates, and constant internet connections. The 2016 Mirai botnet recruited hundreds of thousands of them simply by trying a short list of factory credentials over Telnet.
- Antonakakis, M. et al. (2017). Understanding the Mirai botnet. USENIX Security.
- Stone-Gross, B. et al. (2009). Your botnet is my botnet: analysis of a botnet takeover. ACM CCS.
- Kolias, C. et al. (2017). DDoS in the IoT: Mirai and other botnets. IEEE Computer, 50(7).
05Defending against DDoS
You cannot out-filter a flood that is larger than your own pipe. Volumetric defense has to happen upstream, where capacity is bigger than the attack.
Before an attack
Contract upstream mitigation, overprovision, put public services behind a CDN, hide origin IPs, and rehearse the runbook.
During
Classify the attack type, divert to scrubbing, rate-limit per client, challenge suspicious HTTP clients, and keep status communications going.
Architecture
Autoscaling and caching help with application floods but can turn a DDoS into a large cloud bill; set budget alarms.
- CIC-DDoS2019 dataset — labeled reflection and flood traffic for detection labs
- RFC 5635 — Remote triggered black hole filtering
06How malware spreads
| Type | Spreads by | Needs a user? | Network defense |
|---|---|---|---|
| Worm | Exploiting a network service, then scanning for more | No | Patching, segmentation, block exposed services |
| Virus | Infecting files that people share or run | Yes | Endpoint protection, application allow-listing |
| Trojan | Posing as legitimate software or an attachment | Yes | Email/web filtering, user awareness |
| Lateral movement | Reusing stolen credentials, remote admin tools | No | Least privilege, MFA on admin paths, internal monitoring |
| Supply chain | Riding a trusted software update | No | Integrity checks, vendor scrutiny, egress monitoring |
Modern malware avoids detection rather than just spreading: polymorphic code changes its bytes on every copy, fileless techniques run in memory using built-in tools like PowerShell, and living off the land uses legitimate admin utilities so the activity looks routine.
- VirusTotal — multi-engine file and URL analysis
- CAPE Sandbox documentation — open-source malware sandbox for lab analysis
- ATT&CK TA0008 — Lateral Movement
- Spafford, E. (1989). The Internet worm program: an analysis. ACM SIGCOMM CCR, 19(1).
07Worm dynamics
A scanning worm follows the same curve as an epidemic. Each infected host probes random addresses; early on, nearly every hit is a new victim, so growth is exponential. As the vulnerable population is used up, growth flattens into an S-curve.
Defenses work by changing the curve's parameters: patching shrinks the vulnerable population, segmentation limits what each infected host can reach, and scan rate limiting slows the contact rate enough for responders to act.
- Staniford, S., Paxson, V. & Weaver, N. (2002). How to 0wn the Internet in your spare time. USENIX Security.
- Moore, D. et al. (2003). Inside the Slammer worm. IEEE Security & Privacy, 1(4).
08Phishing and social engineering
Phishing bypasses technical controls by persuading a legitimate user to act. It works because it exploits predictable human responses rather than software bugs.
Spear phishing
Personalized using public information about the target's role, colleagues, and projects.
Business email compromise
Impersonates an executive or vendor to redirect payments. Often no link or malware at all, just a convincing request.
Credential harvesting & AiTM
Fake login pages, increasingly as real-time proxies that relay the password and the MFA code to the real site.
Beyond email
SMS (smishing), voice (vishing), QR codes, collaboration chat, and help-desk impersonation to reset MFA.
- ATT&CK T1566 — Phishing
- FBI Internet Crime Complaint Center (IC3) — annual reports on BEC and phishing losses
- Google phishing quiz — practice spotting phishing
- Dhamija, R., Tygar, J. D. & Hearst, M. (2006). Why phishing works. ACM CHI.
- Thomas, K. et al. (2017). Data breaches, phishing, or malware? Understanding the risks of stolen credentials. ACM CCS.
- Ho, G. et al. (2019). Detecting and characterizing lateral phishing at scale. USENIX Security.
09Defending against phishing
Email authentication
Plain SMTP lets anyone claim any sender. Three DNS-published standards let receivers check whether mail really came from the domain it claims:
| Standard | What it checks | Limitation |
|---|---|---|
| SPF | The sending server's IP is listed by the envelope domain | Breaks on forwarding; checks a hidden address, not the visible From |
| DKIM | A domain's cryptographic signature over headers and body | Proves the signing domain, which may not be the visible From |
| DMARC | SPF or DKIM passes and aligns with the visible From; tells receivers to quarantine or reject failures | Does nothing against look-alike domains |
Email authentication stops exact-domain spoofing. It cannot stop examp1e-help.com, which is why technical controls must be paired with people and process.
Phishing-resistant MFA
FIDO2 security keys and passkeys are bound to the real site's origin, so a proxy page cannot replay them. The single most effective control.
Filtering & isolation
Link rewriting and detonation, attachment sandboxing, blocking newly registered domains, and external-sender banners.
Process
Out-of-band verification for payment and banking changes; help desks that verify identity before MFA resets.
Culture
Easy, blame-free reporting. A user who reports quickly is worth more than one who never clicks.
- RFC 7208 — SPF · RFC 6376 — DKIM · RFC 7489 — DMARC
- MxToolbox email header analyzer — read SPF, DKIM, and DMARC results in a real header
- FIDO Alliance — passkeys
- internet.nl — test a domain's email authentication setup
10Case studies
Dyn DNS (2016)
Mirai-infected IoT devices flooded a major DNS provider, making large websites unreachable for hours even though their own servers were fine. Lesson: shared dependencies concentrate availability risk, and insecure consumer devices become everyone's problem.
WannaCry (2017)
A ransomware worm spread through an SMBv1 flaw for which a patch had been available for two months, disrupting hospitals and factories worldwide. Lesson: unpatched, flat networks let one infection become thousands.
Business email compromise
Year after year, FBI reports put BEC among the costliest cybercrimes, typically with no malware at all. Lesson: process controls on payments matter as much as technical filters.
11Common misconceptions
—References
Peer-reviewed
- Antonakakis, M. et al. (2017). Understanding the Mirai botnet. USENIX Security. usenix.org
- Dhamija, R., Tygar, J. D. & Hearst, M. (2006). Why phishing works. ACM CHI. doi:10.1145/1124772.1124861
- Ho, G. et al. (2019). Detecting and characterizing lateral phishing at scale. USENIX Security. usenix.org
- Kolias, C. et al. (2017). DDoS in the IoT: Mirai and other botnets. IEEE Computer, 50(7). doi:10.1109/MC.2017.201
- Mirkovic, J. & Reiher, P. (2004). A taxonomy of DDoS attack and DDoS defense mechanisms. ACM SIGCOMM CCR, 34(2). doi:10.1145/997150.997156
- Moore, D. et al. (2003). Inside the Slammer worm. IEEE Security & Privacy, 1(4). doi:10.1109/MSECP.2003.1219056
- Moore, D. et al. (2006). Inferring Internet denial-of-service activity. ACM TOCS, 24(2). doi:10.1145/1132026.1132027
- Paxson, V. (2001). An analysis of using reflectors for distributed denial-of-service attacks. ACM SIGCOMM CCR, 31(3). doi:10.1145/505659.505664
- Rossow, C. (2014). Amplification hell. NDSS. doi:10.14722/ndss.2014.23233
- Spafford, E. (1989). The Internet worm program: an analysis. ACM SIGCOMM CCR, 19(1). doi:10.1145/66093.66095
- Staniford, S., Paxson, V. & Weaver, N. (2002). How to 0wn the Internet in your spare time. USENIX Security. usenix.org
- Stone-Gross, B. et al. (2009). Your botnet is my botnet. ACM CCS. doi:10.1145/1653662.1653738
- Thomas, K. et al. (2017). Data breaches, phishing, or malware? ACM CCS. doi:10.1145/3133956.3134067