HTTP Flood and Application-Layer Attacks

What it exhausts

Work. Application worker threads, database connections, cache capacity, and the CPU spent on whatever the request asked for RFC 4732.

The consequence is that this class breaks the usual mental model. A volumetric attack is visible on any bandwidth graph; an application-layer flood can be invisible on all of them while the service is entirely unavailable.

Where the leverage comes from

The attacker’s advantage is asymmetry of cost. A request is cheap to send and can be expensive to answer: a search across a large corpus, a report that aggregates, a login that hashes a password deliberately slowly, a query that misses every cache.

Finding those endpoints is not hard — they are usually the ones a normal user waits for. An attack that targets them extracts far more damage per packet than any flood.

Variants worth separating

Cache-bypass requests append varying query strings or target personalised paths, so a CDN forwards every one to the origin. The CDN is working correctly and providing no protection.

Low-and-slow holds connections open while sending very slowly, consuming concurrency rather than throughput. Covered separately in the slow-HTTP class.

HTTP/2 Rapid Reset exploits stream multiplexing RFC 9113: many streams opened and cancelled on one connection, each causing request-handling work that is then thrown away. This is the vector behind the 2023 record requests-per-second attacks, and the corresponding CVE is in the CVE dataset.

Login and authentication floods aim specifically at the most expensive path most applications have, and have a second purpose beyond denial of service.

Observable telemetry

• Requests per second per endpoint, with the distribution skewed toward the expensive ones.
• Cache hit rate falling while request rate rises.
• Backend connection pool at its ceiling while front-end bandwidth is unremarkable.
• Latency distribution widening at p95 and p99 before the mean moves.
• Source diversity that is either unusually low or unusually high for that endpoint.
• For HTTP/2: streams opened and reset at a high rate on few connections.

Common false positives

This class produces the highest false-positive risk on the site, because a successful business event looks like an attack in every aggregate metric. A product launch, a broadcast mention, a sale, a new mobile client release — all of them raise request rate, lower cache hit rate and concentrate load.

The distinguishing evidence is usually behavioural rather than volumetric: do the sessions look like sessions, does the endpoint mix match a human journey, do clients fetch the assets a page needs. A defence that judges on rate alone will block the best day the business has had.

Mitigation by layer

Upstream — almost nothing to do. The volume is not the problem.

CDN or reverse proxy — cache aggressively, and treat cache-bypass patterns as the specific thing to detect.

Rate limiting, applied to the expensive operation rather than to the client, as the rate limiting page argues at length.

Behavioural detection for the part rules cannot express, with its costs understood — baselining.

The application itself. Timeouts, connection pool limits, query cost ceilings and circuit breakers. This is the layer that decides whether a flood is an incident or a slow hour, and it is covered per platform in the hardening section.

Operational pitfalls

Blocking by source address fails against distributed sources and blocks shared NAT.

Tightening a global rate limit during an incident is the fastest route to compounding an attack with a self-inflicted outage.

Assuming the CDN is protecting you without checking what fraction of requests reach the origin.

Not knowing your own expensive endpoints before the incident, which turns the first hour into research.

Safe validation

Replay your own traffic, against your own infrastructure, with authorisation. Measure the false-positive rate at a genuine business peak rather than in a quiet window — the proof-of-concept methodology sets out why that distinction decides most evaluations.

Sources