Akamai Technologies, Inc., a global leader in content delivery network (CDN) services, released its Third Quarter, 2016 State of the Internet / Security Report.
The report, using data gathered from the Akamai Intelligent Platform, provides analysis of the current cloud security and threat landscape, including insight into two record‑setting DDoS attacks caused by the Mirai botnet.
Highlights from Akamai’s Third Quarter, 2016 State of the Internet / Security Report include:
DDoS Attacks
- The two largest DDoS attacks this quarter, both leveraging the Mirai botnet, were the biggest observed by Akamai to-date – recorded at 623 Gbps and 555 Gbps.
- Compared to Q3 2015, total DDoS attacks increased 71 percent in Q3 2016.
- During the third quarter, Akamai mitigated a total of 4,556 DDoS attacks, an 8% decrease from Q2.
- There were 19 mega attacks mitigated in Q3 that peaked at more than 100 Gbps, matching the Q1 2016 highpoint.
- Q3 2016 showed that NTP reflection attacks are apparently becoming a less viable option for attackers. The average size of an attack relying solely on NTP reflection is approximately 700 Mbps, a significant drop from the June 2014 average of more than 40 Gbps.
Web Application Attacks
- Q3 2016 showed an 18 percent decrease in total web application attacks from Q3 2015.
- In Q3 2016, web application attacks sourced from the United States decreased by 67 percent from Q3 2015.
- Brazil, the top country of origin for all web application attacks in Q2 2016, experienced a 79 percent decrease in attacks this quarter. The United States (20 percent) and Netherlands (18 percent) were the countries with the most web application attacks.
- Web application attack metrics measured around major sporting events suggest malicious actors may take time off to watch their favorite teams. For example, on the day that France played Portugal in the European soccer championship, there was a 95 percent decrease in attacks sourcing from Portugal (20 attacks) as opposed to a day one month later (392 attacks). On the same day in France, there were 50,597 attacks as compared to 158,003 one month later – a 68 percent difference.
Spotlight on Attack Vectors
- UDP fragments and DNS reflection attacks were the two most common vectors in Q3, accounting for 44 percent of all vectors – an increase of 4.5 percent from Q2.
- Application layer attacks drove just 1.66 percent of all DDoS attacks, likely because of the level of technical knowledge needed to execute them. Infrastructure layer attacks are much easier to launch with point-and-click tools.
[PDF Download]– Akamai Q3 2016 State of the Internet – Security Report