23rd October 2025 | Member Insight | FastNetMon

DDoS attacks are no longer just a technical inconvenience—they are a strategic threat. From major cloud providers to critical infrastructure, organisations face attacks that can disrupt services, erode trust, and incur significant financial and reputational costs. At FastNetMon, we’ve spent over a decade analysing these threats, and we’ve developed a practical, structured model - the FastNetMon DDoS Taxonomy - to help engineers, defenders, and decision makers understand exactly what they’re dealing with and respond effectively.

Why does a taxonomy matter?

In the heat of a DDoS attack, seconds matter. Without a clear understanding of the attack type, teams risk applying the wrong mitigation and turning a manageable incident into a major outage. A taxonomy provides a shared mental model, turning chaotic incidents into predictable, repeatable response playbooks.

This becomes critical in today’s world of hyper-volumetric floods and extreme packet rates. When attacks can ramp up to terabit scale in seconds, manual triage simply won’t keep pace. Defenders need automation — and automation only works if it’s built on solid logic. To create reliable rules, you first need to break down your attack surface: which resources are exposed, which vectors are most likely, and which countermeasures fit each case.

A clear taxonomy is the foundation for that logic. It ensures both humans and systems can make fast, correct decisions — so the right mitigation fires automatically, without wasting cycles or dropping legitimate traffic.

The FastNetMon DDoS taxonomy

We classify DDoS attacks based on the resources they target, providing a framework that supports both technical response and strategic planning.

Volumetric / amplification attacks - "Will it fill my pipes?"

These attacks target network capacity, overwhelming routers, firewalls, and infrastructure before traffic reaches applications. Classic examples exploit DNS or NTP, while modern trends include Memcached and QUIC-based amplification. Stealth techniques such as “carpet-bombing” distribute traffic across IP ranges to evade detection.

Transport / state-exhaustion attacks - "Will it overwhelm my connection tables?"

These attacks exploit the asymmetry in computing resources, where a small number of packets consume disproportionately large amounts of CPU, memory, or table entries. Modern threats target HTTP/2, gRPC, and QUIC, often using subtle modulation techniques like pulse-wave attacks to evade baseline detection.

Application-layer & low-and-slow attacks - "Will it burn my backend?"

Layer-7 attacks focus on CPU, memory, and application logic, often staying below volumetric detection thresholds. They exploit APIs, WebSockets, GraphQL, and gRPC to exhaust backend services. Even sophisticated CDNs or WAFs can be bypassed through query variation or slow, persistent traffic.

Emerging and evasive techniques

The DDoS landscape continues to evolve. IPv6 amplifiers, WebTransport and WebRTC relay abuse, and AI-driven bots are reshaping the attack surface. Detection now requires correlating traffic across subnets, analysing protocol behaviour, and monitoring time-based anomalies.

Turning Classification into Action

A taxonomy only becomes useful when it drives the right mitigation. Each class of attack demands a different defensive posture — and applying the wrong control can be just as damaging as the attack itself. Here’s how classification translates into action in practice:

Volumetric & amplification attacks – The goal is to stop traffic before it saturates links. Operators typically combine BGP Flowspec rules, remote triggered blackholing (RTBH), and traffic diversion to scrubbing centres. These controls filter or reroute the flood upstream, preserving capacity for legitimate traffic. Effective automation means triggers based on pps/bps thresholds or protocol anomalies can inject rules within seconds, without waiting for human approval.
Transport & state-exhaustion attacks – These target the connection-handling logic of firewalls, proxies, and load balancers. Defences rely on protocol hardening: SYN cookies for TCP, retry tokens for QUIC, header size caps, and per-source connection limits. Rate-limiting connection attempts, rather than raw bandwidth, is key here. Automating these safeguards requires monitoring conn/sec rates and quickly applying rules that throttle abusive flows without cutting off legitimate users.
Application-layer & low-and-slow attacks – These slip past volumetric thresholds and exploit app logic. Mitigation must be closer to the application: dynamic rate-limiting per endpoint, query caps on APIs, circuit breakers, and WAF/CDN integration for filtering. For example, Slowloris-style attacks can be countered by enforcing minimum data rates, while GraphQL floods demand schema depth limits. Effective automation here is more than blocking IPs — it means recognising attack patterns and pushing adaptive policies in real time.
Emerging & evasive techniques – Modulation attacks like carpet-bombing and pulse-wave floods require broader telemetry across subnets and time windows. This is where visibility platforms alone fall short: you need correlation across /24s, anomaly detection over time, and automated orchestration of multiple controls. For example, detecting a pulse-wave pattern should trigger not just a block, but a scheduled hold-open of mitigation rules to withstand the next burst.

The real value of classification is that it enables automation with confidence. Instead of generic “block all” responses, defenders can load tailored playbooks: volumetric floods trigger upstream diversion, state exhaustion triggers protocol hardening, and application abuse triggers rate-limiting. This precision keeps defences effective while minimising collateral damage.

Why does this matter for business leaders?

DDoS is no longer just a network engineering problem — it is a business continuity risk. Outages caused by a missed or delayed response can mean lost revenue, regulatory penalties, and long-term brand damage. The challenge for executives is that DDoS defence is highly technical, yet the consequences are deeply strategic.

A clear taxonomy bridges this gap. It gives leaders a structured way to understand what different classes of attacks actually mean for their organisation:

Volumetric floods translate to lost connectivity and downtime for customer-facing services.
State-exhaustion attacks can silently cripple firewalls and proxies, disrupting internal operations and customer logins.
Application-layer abuse directly impacts critical revenue systems — from e-commerce checkouts to financial APIs.
Evasive techniques challenge detection, raising the risk of hidden outages or degraded performance.

By mapping technical vectors to business impact, leaders can make better decisions about investment, risk appetite, and incident response priorities. It helps justify why automation matters — because at terabit scale, human intervention is too slow to protect revenue or reputation.

For boards and executives, the taxonomy provides a lens to translate complex attack types into clear operational and financial risk categories. This ensures that when the next large-scale attack happens, the conversation is not just “what’s happening on the network?” but “how do we keep the business running?”

Conclusion

DDoS attacks will continue to grow in sophistication and scale. But with a structured classification model, organisations can move from reactive firefighting to proactive risk management. The FastNetMon DDoS Taxonomy equips teams with the insight to recognise threats, act decisively, and protect the digital services that modern business relies on.

About FastNetMon

FastNetMon is a trusted leader in network security, specialising in DDoS protection. FastNetMon’s platform combines real-time network visibility with automated response. Built for ISPs, enterprises, and cloud providers, it detects attacks in seconds and triggers countermeasures such as BGP Flowspec, RTBH or scrubbing centre traffic diversion to keep critical services online.

For more information, visit https://fastnetmon.com