Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!


DDoS Trends (Sept 18, 2023)
New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

DDoS Trends (Sept 18, 2023)

MrRadicMrRadic Patron Provider, Veteran

We've visualized DDoS attack trend data in a weather forecast style.

Temp (in *F) = Higher temps means larger attacks
% Chance Rain = Higher % chance of rain means more frequent attacks.

Feel free to ask any questions.

Comments

  • Looks cool, but it doesn't tell me much. "Larger" attacks, compared to what? Frequency compared to what? How are the values calculated? What is the baseline?

  • vpsGODvpsGOD Member, Host Rep

    Make a graph similar to https://www.digitalattackmap.com and expose all the attacker ip and volume to community ;)

  • MrRadicMrRadic Patron Provider, Veteran

    @jtk said:
    Looks cool, but it doesn't tell me much. "Larger" attacks, compared to what? Frequency compared to what? How are the values calculated? What is the baseline?

    These aren't designed to have a direct correlation to attacks. It's setup to be relative and show trends.

  • MrRadicMrRadic Patron Provider, Veteran

    @vpsGOD said:
    Make a graph similar to https://www.digitalattackmap.com and expose all the attacker ip and volume to community ;)

    No benefit to what we're trying to achieve.

  • @MrRadic said:

    @jtk said:
    Looks cool, but it doesn't tell me much. "Larger" attacks, compared to what? Frequency compared to what? How are the values calculated? What is the baseline?

    These aren't designed to have a direct correlation to attacks. It's setup to be relative and show trends.

    Trends or forecasts? Why confuse with weather terms? Perhaps this makes sense to others, not I.

    Thanked by 1emgh
  • MrRadicMrRadic Patron Provider, Veteran

    @TimboJones said:

    @MrRadic said:

    @jtk said:
    Looks cool, but it doesn't tell me much. "Larger" attacks, compared to what? Frequency compared to what? How are the values calculated? What is the baseline?

    These aren't designed to have a direct correlation to attacks. It's setup to be relative and show trends.

    Trends or forecasts? Why confuse with weather terms? Perhaps this makes sense to others, not I.

    Nothing more than a marketing exercise.

    Thanked by 1Kris
  • @MrRadic how about types of attacks and types of targets? that would be interesting.

  • MrRadicMrRadic Patron Provider, Veteran

    @JoeMerit said:
    @MrRadic how about types of attacks and types of targets? that would be interesting.

    Mostly UDP reflection, mostly game servers.

  • I'd be curious to understand the actual methodology used to estimate forecasts.

    Mostly because I'm skeptical on the utility of these results without understanding how the methodology might be missing in certain areas.

  • If it was interactive (not live, that would cause serious increase in attacks) that’d be cool, like a live weathermap (like OVH) but for DDoS and not live

  • stefemanstefeman Member
    edited September 2023

    @HalfEatenPie said:
    I'd be curious to understand the actual methodology used to estimate forecasts.

    Mostly because I'm skeptical on the utility of these results without understanding how the methodology might be missing in certain areas.

    The utility is that he can spam new thread every day if needed, and get relevant exposure to his company without breaking any rules.

    The idea is to show that he can handle attacks and if customer asks in this thread, he will try to advertise or sell directly via the answer. Its the same thing that racknerd does when they ask users to spam to keep the topic at the top.

    Thanked by 3fluffernutter Kris emgh
  • @stefeman said:

    @HalfEatenPie said:
    I'd be curious to understand the actual methodology used to estimate forecasts.

    Mostly because I'm skeptical on the utility of these results without understanding how the methodology might be missing in certain areas.

    The utility is that he can spam new thread every day if needed, and get relevant exposure to his company without breaking any rules.

    The idea is to show that he can handle attacks and if customer asks in this thread, he will try to advertise or sell directly via the answer. Its the same thing that racknerd does when they ask users to spam to keep the topic at the top.

    I'm not saying you're wrong. But that doesn't really answer my question. I'm interested in the methodology because there are various ways to forecast these types of events but the assumptions that go into the model impact the interpretation of the results.

    I mean presenting it weather terms (percent precipitation vs absolute temperature) doesn't make any sense to me and I'd recommend changing that to something more relevant (I get it makes it a bit quirky, but it's just an unnecessary step to actually interpreting the results). Infrastructure is based on capacity and management of capacity for extreme events so there can be some utility taken that may be beneficial for others or may actually show shortcomings of ReliableSite's infrastructure where others may show their strength.

    However, if there's at least some kind of citation they can offer for the forecast methodology then it'd be better understood for what it is.

  • It's a bullshit forecast with really no meaning, and as mentioned (honestly to their benefit) just a marketing exercise, a poor one at that.

    Kind of pissed as they could generate actually useful stats such as top attacking ASN's, highest attack filtered, etc.

    These are things that would make me think they have a good service piping through to Grafana or something.

    Instead, I just get pissed when I see these threads, knowing with an ounce of programmer time and some ChatGPT they could likely chart something useful rather than marketing masquerading as something other than such.

    Thanked by 3emgh fluffernutter kait
  • DataIdeas-JoshDataIdeas-Josh Member, Patron Provider

    @Kris said:
    It's a bullshit forecast with really no meaning, and as mentioned (honestly to their benefit) just a marketing exercise, a poor one at that.

    Kind of pissed as they could generate actually useful stats such as top attacking ASN's, highest attack filtered, etc.

    These are things that would make me think they have a good service piping through to Grafana or something.

    Instead, I just get pissed when I see these threads, knowing with an ounce of programmer time and some ChatGPT they could likely chart something useful rather than marketing masquerading as something other than such.

    I get your frustration but I do have to ask... Are you okay? How has your week been going?

    Thanked by 4kait vovler emgh RIYAD
  • @DataIdeas-Josh said: I get your frustration but I do have to ask... Are you okay? How has your week been going?

    My week's been awesome.

    They give a reverse forecast of the past week with 43 degrees one day, and 77 the next.

    As they mentioned, it's just a marketing exercise, but still confusing, and doesn't really offer their brand anything, actually makes them seem more amateurish than they are.

    Hope the Raspberry Pi sales are going well!

    Thanked by 3emgh kait fluffernutter
  • @DataIdeas-Josh said:

    @Kris said:
    It's a bullshit forecast with really no meaning, and as mentioned (honestly to their benefit) just a marketing exercise, a poor one at that.

    Kind of pissed as they could generate actually useful stats such as top attacking ASN's, highest attack filtered, etc.

    These are things that would make me think they have a good service piping through to Grafana or something.

    Instead, I just get pissed when I see these threads, knowing with an ounce of programmer time and some ChatGPT they could likely chart something useful rather than marketing masquerading as something other than such.

    I get your frustration but I do have to ask... Are you okay? How has your week been going?

    lmao

    you have to agree though, it's not saying anything at all

    Thanked by 2kait fluffernutter
  • @emgh said: you have to agree though, it's not saying anything at all

    Would be better to have this for marketing and something more techy for us techy people. Loved the article from thehackernews "Gcore Thwarts Massive 650 Gbps DDoS Attack on Free Plan Client" its super flashy but also says a lot for the more techy people.

    Thanked by 1emgh
  • @kait said:

    @emgh said: you have to agree though, it's not saying anything at all

    Would be better to have this for marketing and something more techy for us techy people. Loved the article from thehackernews "Gcore Thwarts Massive 650 Gbps DDoS Attack on Free Plan Client" its super flashy but also says a lot for the more techy people.

    Just skimmed it but I still see enough graphs and numbers to know that there's some juicy info, completely agreed, I wouldn't have this negative take if this actually contained anything useful

    Providers explaining how their filtration works (not in depth so that they get fucked over but just generally) through actual DDoS events would be awesome, I'd have nothing against it

    Thanked by 3kait fluffernutter Kris
  • @emgh said: not in depth so that they get fucked over but just generally

    Yeah, but I would love to know all the indepth stuff as well :( I need to consume all the trade secrets.

    Thanked by 2emgh fluffernutter
  • chihcherngchihcherng Veteran
    edited September 2023

    Suppose he releases the source IP addresses and UDP port numbers of those DDoS attacks, which he mentioned are primarily DNS amplifications. In that case, it's possible to do something to reduce the scale of future DDoS attacks.

  • MikeAMikeA Member, Patron Provider

    @chihcherng said:
    Suppose he releases the source IP addresses and UDP port numbers of those DDoS attacks, which he mentioned are primarily DNS amplifications. In that case, it's possible to do something to reduce the scale of future DDoS attacks.

    Most: 53, 123, 11211, 27005-27015, 389

    Thanked by 1fluffernutter
  • @MikeA said:

    @chihcherng said:
    Suppose he releases the source IP addresses and UDP port numbers of those DDoS attacks, which he mentioned are primarily DNS amplifications. In that case, it's possible to do something to reduce the scale of future DDoS attacks.

    Most: 53, 123, 11211, 27005-27015, 389

    Source IP addresses using source port number 53 (UDP) may indicate the presence of an open resolver. The server owner might be unaware that their server is vulnerable to exploitation by anyone. By informing them of this issue, they might take steps to rectify it.

    Reducing the number of open resolvers can significantly mitigate the scale of future DDoS attacks.

  • I guess the frustration lies in the fact they're a solid provider with the ability to graph interesting things, which is a legit and interesting marketing exercise.

    Even if it isn't sharing direct IPs, but rather ASNs, ports, say top 10 attacking ASNs, top 5 attacked ports, traffic deflected or mitigated total, etc.

    Also a forecast is forward looking, these are trends, going a week back. I guess without signatures on it doesn't make sense and almost seems like a troll

    Thanked by 1emgh
  • emghemgh Member
    edited September 2023

    @Kris said:
    I guess the frustration lies in the fact they're a solid provider with the ability to graph interesting things, which is a legit and interesting marketing exercise.

    Yes

    @Kris said:
    Also a forecast is forward looking, these are trends, going a week back. I guess without signatures on it doesn't make sense and almost seems like a troll

    It’s funny how this is your last point, when it’s so obvious, how can they gather data from the PAST and call it a FOREcast lol

    @MrRadic I hope you can see the constructiveness in the above critisism, you have the resources to make useful and/or cooler stuff so people (including me) are expecting more because of that

  • MrRadicMrRadic Patron Provider, Veteran

    @emgh said:

    @Kris said:
    I guess the frustration lies in the fact they're a solid provider with the ability to graph interesting things, which is a legit and interesting marketing exercise.

    Yes

    @Kris said:
    Also a forecast is forward looking, these are trends, going a week back. I guess without signatures on it doesn't make sense and almost seems like a troll

    It’s funny how this is your last point, when it’s so obvious, how can they gather data from the PAST and call it a FOREcast lol

    @MrRadic I hope you can see the constructiveness in the above critisism, you have the resources to make useful and/or cooler stuff so people (including me) are expecting more because of that

    Yep, I'll include more details on how we put everything together in the next post.

    Thanked by 2emgh Kris
Sign In or Register to comment.