Victimization in DDoS Attacks: The Role of Popularity and Industry Sector

DDoS attacks could have an economic motive such as extortion, but also social and political such as hacktivism and state-sponsored warfare. Hence, the monetary value of the targets does not always explain the victimization. To counter DDoS threats, cloud providers utilize more robust, distributed networks and implement DDoS evasion techniques such as Anycast. However, by hosting many targets under a single infrastructure, they also accumulate threats, which together might exceed the ability of the infrastructure. We approach the victimization problem by using VIVA (value, inertia, visibility, and access) attributes of the DDoS victims to understand what makes them a suitable target for DDoS attacks. We conduct a large-scale analysis of DDoS attack incidents inferred from traffic data recorded by a network telescope over a five-year period. Using Alexa rank and content category of the domain names associated with the targeted IP addresses, we infer the targets’ popularity and industry sector to estimate their