Botnets as Root-Cause. These days, DDoS attacks are
typically performed by so-called botnets, i.e., networks
of compromised machines under the control of an attacker
(often called botmaster) [6,8,19]. A typical DDoS
attack is carried out as follows: the botmaster instructs
the infected machines to perform an attack against a specific
victim, and then all these machines (called bots)
overwhelm the victim with requests by for example sending
SYN packets (leading to resource starvation at the
victim) or large UDP packets (leading to congestion of
the network link). This is the same basic mechanism that
was used by trin00, with the difference that the malicious
code used in modern attacks and the flooding techniques
have evolved over time