Scoring DDoS Attack Complexity: From Simple Floods to Sophisticated L7 Campaigns

When security teams think about DDoS attacks, they often think about volume: gigabits per second, packets per second, requests per second. Bigger numbers mean bigger threats. This mental model is intuitive, widely taught, and dangerously incomplete.

A 100 Gbps volumetric flood aimed at saturating a network link is loud, visible, and well-understood by modern scrubbing services. A 500 Mbps application-layer attack that targets a specific API endpoint with valid-looking requests, rotates its fingerprint every 30 seconds, and adapts to the defenses it encounters is a fundamentally different problem. The first attack requires bandwidth. The second requires intelligence.

At DDactic, we have spent months cataloging, classifying, and scoring DDoS attack types. The result is a taxonomy of 233 distinct attack techniques and a matrix of 211 attack vectors mapped across six defense architectures. This article explains the framework we use to score attack complexity and why that score matters more than raw volume for defense planning.

The Three Layers of DDoS

Before discussing complexity, it helps to establish the playing field. DDoS attacks operate across three layers of the network stack, each with different characteristics, different tooling, and different defense requirements.

Most organizations have some protection at the network layer, typically through their ISP or a cloud scrubbing service. Fewer have effective protection at the transport layer. And at the application layer, where rate limits may not count traffic accurately and business logic is exposed, the gap between assumed and actual protection widens dramatically.

Layer 7 DDoS attacks now represent more than 70% of all DDoS incidents tracked by major vendors. This shift matters because L7 attacks are inherently more complex, harder to distinguish from legitimate traffic, and less dependent on raw volume to succeed.

Attack Complexity Scoring

DDactic classifies every attack technique on a 1-10 complexity scale. This score reflects how difficult the attack is to execute, how hard it is to detect, how resistant it is to standard mitigations, and how much expertise is required to deploy it effectively. The scale breaks into four tiers.

The scoring is not arbitrary. Each level corresponds to specific technical characteristics that determine how the attack interacts with defense layers.

What Each Score Level Actually Means

Score	Detection Difficulty	Mitigation Approach	Example Techniques
1-2	Trivial. Volume spike is immediately visible.	Blackhole routing, upstream scrubbing	ICMP flood, UDP flood, DNS amplification
3-4	Easy. Pattern matches known signatures.	Signature-based WAF rules, SYN cookies	SYN flood, NTP amplification, basic HTTP GET flood
5-6	Moderate. Requires behavioral analysis.	Rate limiting, JavaScript challenges, connection limits	Slowloris, HTTP POST flood, cache bypass, header manipulation
7-8	Hard. Mimics legitimate traffic closely.	ML-based anomaly detection, application-aware filtering	API abuse with valid tokens, multi-vector L3+L7, geographic rotation
9-10	Very hard. May be indistinguishable from real users.	Vendor-specific tuning, manual intervention, protocol-level patches	HTTP/2 Rapid Reset, defense-aware adaptive campaigns, zero-day protocol abuse

Why Complexity Matters More Than Volume

The DDoS industry has trained organizations to think in bandwidth. Vendor marketing highlights record-breaking attacks: 3.47 Tbps against Azure, 5.6 Tbps targeting OVH. These numbers are real, but they are misleading as a threat model for most organizations.

Here is the reality: a 1 Gbps application-layer attack can be more damaging than a 100 Gbps volumetric flood.

This is not a theoretical claim. It is a mathematical consequence of how modern infrastructure processes traffic at different layers.

• Volumetric attacks are absorbed by upstream infrastructure. Any cloud provider or CDN with a multi-terabit network can absorb a 100 Gbps flood without your servers noticing. This is table stakes in 2026.
• L7 attacks reach your application code. A request that passes through the CDN, passes the WAF, passes the rate limiter, and hits your database query is infinitely more expensive per byte than a dropped UDP packet. A single API call that triggers a complex database join can consume more server resources than megabytes of volumetric traffic.
• Complex attacks evade automated defenses. Signature-based detection does not work against attacks that use valid HTTP methods, valid headers, valid cookies, and valid authentication tokens. As we found in our OPI industry benchmarks, organizations scoring poorly on L7 resilience are often the same ones scoring well on basic defense coverage. The defenses exist, but they are tuned for simple attacks.

This is why DDactic's DDoS testing methodology emphasizes complexity escalation rather than volume escalation. Starting at score 1 and incrementally increasing through the complexity spectrum reveals the actual breaking point of each defense layer.

The Attack Vector Matrix

A single attack technique can manifest differently depending on the target's architecture. An HTTP/2 multiplexing attack behaves differently against Cloudflare than against AWS ALB, and differently again against an on-premises Radware AppWall. The technique is the same, but the vector, meaning the specific path the attack takes through the target's defense stack, varies.

DDactic maintains a matrix of 211 attack vectors mapped across six common defense architectures:

1. CDN + Cloud WAF (e.g., Cloudflare, Akamai, Fastly)
2. Cloud-native protection (e.g., AWS Shield + WAF, Azure DDoS Protection + Front Door)
3. On-premises appliance (e.g., Radware DefensePro, F5 BIG-IP, Arbor AED)
4. Hybrid (cloud scrubbing + on-prem appliance)
5. DNS-only protection (e.g., NS1, Neustar UltraDNS)
6. Unprotected / minimal (direct-to-origin, ISP-only)

Each cell in the matrix contains three data points: the complexity score for that specific vector-architecture combination, the expected mitigation effectiveness of default configurations, and the escalation path if the initial technique is blocked.

This matrix is not theoretical. It is built from DDactic's internal research into vendor behavior, protocol handling, and defense bypass techniques. When we assess an organization's DDoS posture, the matrix tells us which attack vectors are most likely to succeed against their specific architecture, allowing us to prioritize testing and recommendations accordingly.

Anatomy of a Multi-Vector Campaign

Real-world attacks rarely stay at a single complexity level. Modern DDoS campaigns are multi-phase operations that escalate through the complexity spectrum, probing defenses and adapting in real time. A typical sophisticated campaign follows a pattern like this:

Each phase tests a different layer of defense. An organization that handles Phase 2 confidently may crumble in Phase 4. One that survives Phase 4 may be unprepared for the fingerprint rotation in Phase 5. The campaign's strength is not any single phase. It is the combination, and the attacker's ability to shift tactics based on what they observe.

Testing Across the Complexity Spectrum

If your DDoS testing only covers simple attacks, you are validating the locks on the front door while leaving the windows open. The problem is not that simple-attack testing is wrong. It is that it gives incomplete information, and incomplete information creates false confidence.

The Escalation Testing Approach

DDactic's simulation engine covers the full complexity spectrum using a methodology we call escalation testing. The process works like this:

1. Baseline (Complexity 1-3): Start with known, well-understood attack types. SYN floods, UDP amplification, basic HTTP floods. This establishes whether foundational defenses are in place and functioning. Most organizations pass this stage.
2. Pressure (Complexity 4-6): Introduce protocol-level attacks and evasion techniques. Slowloris, fragmented packets, cache-busting queries, header randomization. This tests whether defenses can distinguish between unusual traffic and malicious traffic. Many organizations begin to show gaps here.
3. Targeted (Complexity 7-8): Move to application-aware attacks that require knowledge of the target's specific infrastructure. Multi-vector combinations, API endpoint targeting, authenticated request abuse. This tests whether application-layer defenses are tuned for the target's actual attack surface.
4. Adaptive (Complexity 9-10): Deploy attacks that modify their behavior based on the defense response. Fingerprint rotation, challenge-solving, vendor-specific evasion techniques. This tests the upper bound of the defense stack's capability.

The escalation stops when defenses fail or when all complexity levels have been tested. The result is a clear picture of the highest complexity level each defense layer can handle, and the specific point where protection breaks down.

Why This Matters for Defense Planning

Knowing your breaking point changes how you allocate budget. If your infrastructure handles complexity 1-6 but fails at 7, you know exactly what to invest in: application-layer detection, API-specific rate limiting, behavioral analysis. You do not need to buy more bandwidth. You need smarter filtering.

If your infrastructure fails at complexity 3, the answer is different: you need foundational DDoS protection before worrying about advanced evasion. The complexity score prevents organizations from over-investing in sophisticated defenses while basic protections are missing, and prevents them from under-investing in L7 defenses while volumetric protection gives false comfort.

Breaking Point	Diagnosis	Priority Investment
Complexity 1-2	No DDoS protection or misconfigured scrubbing	Cloud DDoS protection service, CDN deployment
Complexity 3-4	Basic protection present but WAF rules are default	WAF tuning, rate limit configuration, origin protection
Complexity 5-6	Good fundamentals but protocol-level gaps	HTTP/2 hardening, connection limits, challenge mechanisms
Complexity 7-8	Strong perimeter but application layer exposed	API security, behavioral detection, application-aware WAF rules
Complexity 9-10	Comprehensive defense, advanced tuning needed	Vendor-specific hardening, zero-day response plan, active threat hunting

Building a DDoS Threat Model Around Complexity

A DDoS threat model that only considers volume is like a building code that only considers earthquakes. Floods, fires, and wind exist too. An effective DDoS threat model considers all three dimensions: the volume an attacker can generate, the complexity of techniques they can deploy, and the duration they can sustain the campaign.

For most organizations, complexity is the dimension where the gap between assumed and actual protection is widest. They have bandwidth to absorb volume. They have timeouts to outlast duration. But they do not have the application-layer intelligence to survive a targeted, complex, adaptive attack.

The attack taxonomy and vector matrix exist to close this gap. By mapping every known attack technique to a complexity score and every vector to a specific defense architecture, DDactic provides security teams with a concrete, testable framework for understanding their DDoS threat model. Not in the abstract, but against specific attacks, at specific complexity levels, targeting their specific infrastructure.