DDoS protection is a service that absorbs very large amounts of fake traffic sent to a website, so that the website stays online for its real users. DDoS stands for distributed denial of service. In a DDoS attack, thousands of hijacked machines send traffic to one website at the same moment. The aim is to use up the website's capacity, so that real users cannot reach it.
The hijacked machines are often cheap internet devices, such as home routers and CCTV cameras, that still use their factory passwords. Attackers take control of them in large numbers. A group of hijacked machines under one attacker's control is called a botnet. Attackers rent out botnets, so a large attack can cost the attacker very little.
There are two main kinds of DDoS attack. The first kind sends more data than the website's internet link can carry. It is measured in gigabits, or even terabits, per second. The page on bandwidth and latency explains how much data a link can carry. The second kind sends requests that look real, such as millions of searches, so that the website's servers run out of capacity.
A DDoS protection company runs a very large network, with data centres in hundreds of cities. All of its data centres announce the same internet address for the protected website. So each visitor's request goes to the nearest data centre. This method is called anycast. An attack from 2 lakh machines around the world is split across many data centres, and no single site receives all of it. In each data centre, software separates the attack traffic from the real traffic, and drops the attack traffic. This is called scrubbing. Only clean traffic goes on to the website.
Consider a news website in Delhi on the evening of state election results. Its normal traffic at that hour is about 4 gigabits per second. At 9 p.m., a botnet starts sending 800 gigabits per second at it. The protection network splits the attack across 300 cities and drops it. The real readers' 4 gigabits per second are sent on to the website's load balancers. Readers notice nothing. A report of the attack goes to the SIEM.
Protection can be always on, or it can start only when an attack begins. For always-on protection, the website's DNS record sends every visitor to the protection network all the time. The protection network's spare capacity is an example of redundancy. Many content delivery networks (CDNs) sell DDoS protection together with content delivery.
In India, a company must report many kinds of cyber attack, including DDoS attacks, to CERT-In, the government's cyber security agency. It must do this within 6 hours of noticing the attack.