What is an application-layer denial-of-service attack?¶
The practical answer¶
An application-layer denial-of-service attack targets the service’s own functions rather than simply flooding the network.
The key evidential caution¶
The dangerous assumption is that low traffic volume means low impact.
A small number of costly requests may exhaust:
Key points¶
- application workers
- database queries
- search functions
- login processing
- file generation
- API limits
- third-party dependencies
What investigators should establish¶
Investigators should identify:
Key points¶
- which application function was targeted
- request type and path
- account or session used
- request rate
- response times
- server errors
- resource consumption
- whether requests were valid in form but abusive in scale or sequence
Legitimate users may make the same individual request.
The malicious element may lie in automation, repetition, timing or deliberate selection of an expensive function.
Evidential limits¶
Do not assume that every performance problem was externally caused. Poor code, database failure or configuration may produce similar symptoms.
Relevant evidence¶
Relevant evidence may include web logs, application logs, database telemetry, performance monitoring, rate-limit events and provider records.
Application-layer attacks may target login, search, report generation or another function that is expensive to process. Preserve the request parameters and resulting database or backend activity. The same endpoint may be harmless under normal use but disruptive when requests are repeated, automated or deliberately crafted.
Where user accounts or session tokens are used, preserve them as well. An application-layer attack may appear as valid authenticated activity even though the requests were automated or abusive. Rate-limit and challenge records may show how the system responded.
Operational takeaway¶
Link repeated or abusive application requests to the specific resource failure, and distinguish malicious use from normal demand and software weakness.