A DDoS, or Distributed Denial-of-Service attack, is an attempt to make a website, application, API, or network service unavailable to legitimate users by overwhelming it with a flood of traffic from many sources at once. The “distributed” element is key: rather than attacking from a single machine, the attacker harnesses a large number of compromised devices – a botnet, often comprising thousands or millions of infected computers, servers, and IoT devices – to generate traffic simultaneously. This distribution makes the attack far more powerful and much harder to block than a single-source denial-of-service.
DDoS attacks come in several categories. Volumetric attacks aim to saturate the target’s bandwidth with sheer traffic volume (for example, UDP floods or amplification attacks that use third-party servers to multiply traffic). Protocol attacks exhaust server or network resources by abusing weaknesses in network protocols (such as SYN floods that leave connections half-open). Application-layer attacks target the application itself – for instance, flooding a resource-intensive API endpoint or web page with seemingly legitimate requests – and are especially insidious because each request can look valid, requiring less traffic to cause harm and evading simple volume-based defenses.
The impact of DDoS is downtime and degradation: legitimate users cannot reach the service, resulting in lost revenue, damaged reputation, and operational disruption. DDoS is also sometimes used as a smokescreen to distract defenders while a more targeted attack is carried out elsewhere. Motivations range from extortion and competition to hacktivism and vandalism.
APIs are increasingly targeted, particularly at the application layer, because a single expensive API call can consume disproportionate backend resources, so relatively modest request volumes can degrade service. Defending against DDoS involves absorbing and filtering malicious traffic before it reaches the target: specialized DDoS mitigation services and content delivery networks that provide large capacity, rate limiting and traffic shaping, anomaly detection to distinguish attack traffic from legitimate spikes, and bot management to identify automated request floods. Because application-layer DDoS blends in with real usage, behavior-aware defenses are particularly important.