Bigger and badder: how DDoS attack sizes have evolved over the last decade

A decade of DDoS growth: what the numbers show

Distributed Denial of Service (DDoS) attacks remain one of the most persistent threats online, flooding targets with excessive requests until bandwidth or compute resources are exhausted. From the start of 2024 alone, Cloudflare has mitigated over 14.5 million DDoS attacks — roughly 2,200 per hour. But how have the largest attacks themselves evolved over the past decade? The answer, based on attack data from Google (2010–2022) extended with Cloudflare's observations from 2023–2024, is clear: growth is exponential, not linear.

Why this matters is straightforward. An accelerating curve in a given metric reveals changes in attacker capability. When the requests-per-second (rps) record jumped dramatically during the HTTP/2 Rapid Reset attacks, for instance, it signaled a new technique rather than simply more of the same. Similarly, tracing traffic sources during such spikes has shown a notable shift from residential and enterprise IP space toward cloud provider IP space — evidence that botnets are moving from IoT devices to virtual machines.

How attacks are measured and defined

Each DDoS metric tells a different story:

• Requests per second (rps): Tracks HTTP or similar protocol requests hitting a target. This is the key metric for Layer 7 attacks aimed at overloading specific applications, APIs, or web servers by exhausting request-handling capacity.
• Packets per second (pps): Counts individual packets regardless of size. Critical for Layer 3 and 4 attacks, where the goal is to overwhelm the packet-processing limits of routers, switches, and firewalls.
• Bits per second (bps): Measures total data throughput. The primary metric for bandwidth-saturation attacks like UDP floods, often cited in terms of gigabits or terabits per second when describing large campaigns.

Defining where a single attack begins and ends can be surprisingly imprecise. Observations may differ across OSI layers, so security teams rely on fingerprinting variables to group events: whether the same attack vectors appear across them, whether targets are shared, and whether payload signatures match — such as distinctive headers or packet structures common to specific botnets like Mirai.

The exponential rise in attack size

The longest available dataset comes from Google, showing attacks from 2010 through 2022 peaking at 6 million requests per second (Mrps) in 2020. That historical trend steepens when Cloudflare's own records from 2023 and 2024 are added:

Cloudflare's 2023–2024 data reveals records of 201 Mrps (September 2024), pps rising roughly tenfold from 230 Mpps in 2015 to 2,100 Mpps in 2024, and bps climbing from a 309 Gbps attack in 2013 to 5.6 Tbps in 2024 — an exponential curve with noticeable acceleration.

That produces substantial multi-year growth rates across each metric:

• Bits per second: 20x increase between 2013 and 2024
• Packets per second: 10x increase between 2015 and 2024
• Requests per second: 70x increase between 2014 and 2024

Selected notable attacks Cloudflare observed from 2021 through 2024 are shown below.

Earlier landmark events — such as the 2018 Memcached amplification wave and 2023's HTTP/2 Rapid Reset campaign — underscore how consistently these records have fallen.

Why duration doesn't tell the story

Attack duration is a poor gauge of aggressiveness. Individual campaigns are often intermittent, can involve multiple simultaneous vectors, and may trigger different defense layers at different times. Traffic patterns vary widely: a single sharp spike, clusters of short bursts, or a continuous sustained load over an extended window. Those characteristics make comparisons difficult and make raw size a more meaningful measure of threat evolution.

From IoT botnets to VM-scale attacks

One structural shift helps explain why attack sizes keep climbing. DDoS infrastructure has moved away from IoT-based botnets and toward VM-based ones hosted on cloud services. Virtual machines offer far more computational and bandwidth capacity, letting attackers generate massive traffic with dramatically fewer compromised machines.

Building a VM botnet also carries lower overhead than infecting thousands of IoT devices. Attackers can spin these up on cloud infrastructure anonymously, often paying with stolen payment credentials sourced from data breaches or Magecart-style web skimming campaigns. The result is a smaller, more capable botnet fleet that avoids much of the complexity involved in managing wide-scale IoT infections — and produces the ever-growing attack sizes that have defined the last ten years.

Why automatic mitigation matters more than ever

DDoS attacks are launched by humans but executed by bots, which means effective defense has to be automated. Real-time detection and mitigation cannot depend on manual intervention — attackers adapt quickly, changing vectors, traffic behavior, and payload signatures in ways that can render static, human-configured rules useless. Automated systems can continuously identify and block attacks on behalf of customers, tailoring protection without waiting for a human response.

Cloudflare’s approach to DDoS defense

Cloudflare’s Connectivity Cloud, built on its anycast global network, defends against DDoS attacks through automation, distributed traffic handling, and layered protection. The network spans more than 330 cities worldwide, and IP anycast spreads attack traffic across multiple data centers. That distribution prevents any single server or network from bearing the full brunt of an attack, helping absorb even large-scale volumetric floods.

Detection relies on machine learning algorithms that identify suspicious traffic patterns in real time. By automating the detection process, Cloudflare can recognize and block attacks quickly — a critical capability when traffic volumes would overwhelm human responders. The defense spans multiple layers: network (Layer 3), transport (Layer 4), and application (Layer 7), allowing mitigation strategies tailored to the specific attack type, including complex, multi-layered campaigns. Full technical details are available in Cloudflare’s DDoS protection documentation.

Since 2017, Cloudflare has provided unmetered DDoS mitigation, meaning customers are protected without bandwidth or cost limitations during attacks. This ensures organizations of any size or budget can access robust protection without worrying about the financial impact of a sudden traffic surge.

The combination of a distributed global infrastructure, automated detection, and multi-layer mitigation allows Cloudflare to detect, absorb, and stop DDoS attacks at scale, maintaining service reliability even as attack frequency and intensity grow. For organizations of every size, defending against bot-driven threats requires tools that can react as fast as the attackers change their tactics — automated, real-time systems are the only practical way to stay ahead. More information is available in the public technical documentation.