I am reading a survey on DDoS attacks and they describe how these attacks can be classified by either Network/Transport level attacks and Application level attacks. In their examples, they classify DNS flooding as network/transport and DNS amplification as application level. I am not entirely understanding the difference and in my view, am questioning why DNS amplification is not a network/transport layer attack as well.
From my understanding, in DNS flooding, you have distributed bots flooding UDP queries essentially, overwhelming the bandwidth such that legitimate users cannot send their on requests. In DNS amplification, you are spoofing the victim's IP in a DNS request such that when the response comes in, its a multiple times in size going back to the victim. From what I understand this is not exactly targeting any application (such as HTTP floods) and rather both examples are compromising the network resources rather than a victim's system resources. How exactly is DNS amplification considered an application level attack?
Link to survey: http://d-scholarship.pitt.edu/19225/1/FinalVersion.pdf