Turning DDoS controls on is the start. Protection comes from analysing traffic, tuning policy and adapting as attackers do.
Attacks are moving away from obvious volumetric spikes toward low-and-slow, distributed traffic that blends into legitimate application traffic. That is why we treat Akamai protection as a continuous practice, not a one-time configuration.
Two kinds of attack
High volumetric
A sudden jump in requests per second, concentrated on specific endpoints, often from suspicious IPs, networks or ASNs. For example, normal traffic of 500 requests per second rising to 8,000 against login and authentication APIs.
Low volumetric, distributed
Each source stays below configured thresholds. Traffic is spread across many IPs, headers rotate, and the attack persists for hours or days.
Why rate controls alone fall short
| Traffic | Sources | Per source | Total |
|---|---|---|---|
| Legitimate users | 500 | 20 req/s | 10,000 req/s |
| Distributed attack | 1,000 | 15 req/s | 15,000 req/s |
Every attacking source stays under a per-client threshold that legitimate users also need, yet the combined load is larger than all real traffic. Catching it takes request-level analysis.
Our approach
- Analyse traffic in Akamai: request trends, targeted hostnames and paths, IP, ASN and geographic spread, headers, user agents and response codes, to separate real attacks from legitimate surges.
- Tune Rate Control policies against normal application behaviour, balancing bursts against sustained load and APIs against web traffic.
- Investigate high-volume attacks by source distribution, targeted paths, unusual headers and automation signatures, and plan the response on attack characteristics rather than volume alone.
- Mitigate with Rate Control enforcement, targeted rules, IP, network or ASN blocks, header and path conditions, and emergency measures where needed.
- Detect low-volume attacks through deeper analysis of hostnames, URIs, methods, user agents, referers, headers, query parameters, ASNs and geography, then write targeted rules.
What it changes
- Abnormal patterns are identified faster.
- Fewer false positives, because tuning is based on real traffic.
- Coverage for both volume spikes and low-volume attacks.
- Less dependence on vendor support for day-to-day tuning.
Analyse. Tune. Detect. Mitigate. Validate.