Saturday Night Fever: Layer 7 attacks against CloudFlare sites

Cloudflare has observed a significant increase in layer 7 DDoS attacks, with a 10% rise for the first half of 2012 and a 21% increase in large-scale attacks. These attacks are characterized by an attacker making numerous HTTP requests to overwhelm the target server. The source of these attacks is traceable due to the need to establish a TCP connection, with 95.5% of layer 7 DoS attacks originating from just 0.05% of IP addresses connecting to Cloudflare's network. The largest layer 7 attacks occur during nighttime in California and Europe, keeping the team busy around the clock. Interestingly, there are noticeable dips in layer 7 DDoS activity on certain holidays such as Mardi Gras, St. Patrick's Day, Earth Day, Memorial Day weekend, and July 4th. The top five countries from which attacks originate include the US, China, Turkey, Brazil, and Thailand. Cloudflare continues to defend against these attacks using both automated systems and manual tools like "I'm under attack mode."