What is the ratio of "attack packet number/total packet number" for DDOS attack?

Question

What is the ratio of "attack packet number/total packet number" for DDOS attack?

Answer 1

There is no specific ratio of packets. It depends on the frequency of the packets and the speed with which the ISP, the router and the server (if it is a website). There is no specific distinction between a normal data packet and a DDOS packet. Some ticket sales sites have collapsed under the strain when a top band's tickets go on sale. This is not a DDOS attack, but the effect is the same. The connection or the servers attached to that connection cannot take the load and things stop working.

Answer 2

Thank you for the answer, i am working on DDOS detection via IP Flow statistics (Average packet number per flow, port numbers, average packet length etc..) There are too many DDOS datasets to work on it. Some datasets contain only attack packets (UCLA UDP Attack Dataset), some of them contain %30 of attack and some of them contain %5 attack in different time intervals (NUST TCP SYN Flood Dataset). This percentages are "attack packet number/total packet number". If it is over %30, i can find the significant statistical differences between attack and normal time intervals. However, if it is only %5, it is not possible to detect. I couldn't find any definition of DDOS about attack packet percentage. My advisor told me that, efenthough it is %5, you should be able to detect it. However, i think it is unrealistic. So, is there any threshold to call is as "attack"?

Answer 3

don't know but DDOS attacks ping different machines for requests so that those machine then ping the targeted server for a response. this means anything on wifi can partake in a DDOS attack. toasters, refrigerators, and coffee machines can all take part in a virtual bank heist through a DDOS attack. and because the whole point is to overwhelm the target with sheer numbers of packets, the ratio of attacking packets to total packets is probably one where the attacking packets takes up almost all if the packets. im guessing above 90%. might be wrong though.