DDoS on Repeat: Measuring Pulse-Wave DDoS in the Wild

This paper investigates the recent phenomenon of pulse-wave DDoS attacks and studies the characteristics and prevalence of pulsed DDoS attacks in the wild. Despite historical and recent references, no study quantified these attacks on the Internet. The scarcity of measurement studies could be attributed to uncertainty and the inherent challenge of identifying pulsed DDoS attacks, or lack of awareness of the extent of these attacks. Leveraging a dataset captured at a major IXP over four months, we identify pulse-wave attacks from sampled flow-traces, providing insight into 10,000 DDoS attacks. Surprisingly, we observe that 27% of all observed DDoS attacks can be attributed to pulse-wave DDoS events. This shows that pulsed DDoS attacks have emerged as a significant attack tactic and should be considered in future work.