## 2 Taxonomy of DDoS Attacks
### DDoS Attack Architecture
#### 2.2.3 Application-Based DDoS Attacks  
This is also known as a \"Layer 7\" attack because it takes place at the seventh layer of the open system interconnection (OSI) model. The application layer is overloaded with too many login or search requests. These attacks are the hardest to localize because the attacker generates attack traffic at a reduced rate, and the request sent is very similar to regular traffic [45]. The strength of this attack is expressed in requests per second (rps). Examples include HTTP flood, Slowloris, zero-day attack, domain name server (DNS) flood, low and slow attack, and SQL injection [45], among others. Table 3 provides a comparison of the three major attack classifications. The volumetric attack's objective is to jam up the network with many illegitimate network packets. Due to the increasing volume of traffic packets and traffic congestion, the impacted resources are unable to complete any operations or respond to any requests. The protocol-based attack tries to take advantage of flaws in the network protocol to consume the connection status table produced by some network devices. The application attack is more sophisticated and typically starts with minimal bandwidth utilization. The resources of the network are gradually depleted as it targets specific services or applications. To keep the connection active, the attacker sends the requested packets within a very small packet window. Volumetric attacks are the most prevalent types of attacks since they are straightforward and simple to produce. A report presented in [46] (see Figure 7a) revealed the frequency of  
Figure 6: Conventional structure of a volumetric-based DDoS attack. occurrence of each DDoS attack category encountered between January 2020 and March 2021. It was observed that, over those 15 months, over 65.2% of all attacks were volumetric in nature, while protocol-based and application-based DDoS attacks accounted for about 20.5% and 14.3%, respectively. UDP flood attack was reported to have a 62.5% application percentage among these attack categories. Despite the complexity of attacks based on both protocols and applications, application-based attacks are the hardest to localize, since they closely resemble legitimate traffic. In Table 4, an overview of the most common DDoS attack types is presented. The attack features and their effect on the target server are also discussed. A combination of these attacks has been used recently to launch a multi-vector attack. With a fast increase in the development of DDoS detection solutions, attackers have discovered the usage of a variety of attack categories, including volumetric, protocol, and application-specific attacks. These attack vectors can be combined to perform a multi-vector DDoS attack, which has a greater effect on the target server than a single volumetric attack. Multi-vector DDoS attacks have been more common in the IoT network recently. According to a report presented by Nexus Guard [46], attackers have successfully deployed a mix of a UDP flood and an NTP amplification attack, as seen in Figure 7b [47], with a record utilization of 17.06%. Overall, 9.41% of multi-vector attacks utilize ICMP and UDP flooding, while 6.47% of multi-vector DDoS attacks use ICMP, UDP flood, and NTP amplification. \begin{table}
\begin{tabular}{p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt}} \hline \hline
**Attack Type** & **Classification** & **Features** & **IP Spoofing** & **Attacked Layer** & **Effect** \\ \hline TCP-SYN flood & Protocol-based & Exploits TCP’s three-way handshaking. & Spoofed & Transport & Obsess the server’s resources \\ \hline HTTP flood & Application-based & Exploits HTTP GET and HTTP POST request. & Non-spoofed & Application & Consumes server’s entire resources \\ \hline Slowloris & Application-based & Maintains the HTTP sessions for the longest feasible time. & Non-spoofed & Application & Consumes all sockets \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Overview of the most common DDoS attacks.