Netscout doubles DDoS defense capacity to counter AI-driven botnets

Distributed denial of service (DDoS) attacks are changing shape. Attackers now use AI throughout the attack lifecycle, from reconnaissance to exploitation to hardening compromised devices against takeover by rival botnet operators. The result is larger, more coordinated botnets capable of direct, stateful attacks rather than the reflection and amplification techniques that dominated a few years ago.

To keep up, defenders need more intelligence and more bandwidth. That’s what Netscout is targeting with the expansion of its Arbor Cloud DDoS mitigation capacity to 33 Tbps across 16 global scrubbing centers, up from a previous peak of 15 Tbps. The new capacity and capabilities come in part from the acquisition of DigiCert’s DDoS and WAF services, which occurred in May of this year.

“AI is used on the forefront by attackers to carry out social social attacks, carry out infiltrations, look for vulnerabilities, find them quickly and exploit them,” Carlos Morales, senior vice president and general manager of Arbor Cloud at Netscout, told Network World. “The net of that is you get these bigger botnets that what you had before.”

How AI is driving DDoS attack sophistication and volume

Morales pointed to three specific ways AI is reshaping these attacks.

More than amplification. Smaller botnets used to depend on reflection and amplification to punch above their real size, spoofing a target’s address so that third-party DNS or NTP servers would fire oversized replies at the victim instead of the botnet doing the work directly. That dependency also gave attackers a side benefit, since the traffic appeared to originate from those third-party servers rather than from the botnet itself. Morales said today’s larger, AI-expanded botnets do not need that trick anymore. They generate volume directly from the compromised devices under their control. “So prior, the botnets weren’t quite as big,” he said.

AI takes over coordination. Reconnaissance, vector switching, and target selection…