My company has dealt with DDoS attacks up to 180gbps and here are my techniques that I have used to mitigate.
The size of a website doesn't only make it a bigger target, things that also play a significant role are:
- Public relations (Are you marketing yourself as something you are not, what people are you targeting)
- Delivering on promises
- Treating customers the right way
Motives for DDoS attacks include but are not limited to the following:
- Fame ("Oh look at me, I managed to take this site down")
- Money (Larger sites are more expensive to attack, generally if they are looking for money they will target smaller with high revenues that do not have a large technical team)
Also (from one of the comments):
- Another motive is that they are trying to distract you. For example, if they want to attack Apache so you are busy fixing that while they bruteforce your SSH password.
There are many different types of DDoS attacks and how they are initiated, first you need to get the points I listed above in order, then your DDoS attacks will likely decrease. This doesn't mean that you will not experience them anymore, you simply give people less of a motive to attack you.
On a technical level, there are multiple things to consider because most businesses have multiple nodes in their infrastructure. In some cases, each node requires a different type of approach. In my case these nodes were an API, a game server, an authentication server, a database, and a social server. Step 1 was to make sure that you are never exposing an IP address that does not need to be exposed. In my case those were the authentication server, database and social server. Generally limiting the points of failure is a good approach to start with. Protection is incredibly expensive, and it's only good to have the most resilient protection where you really need it most.
After you have determined which points are required to be public, you can protect each function individually in the way they need to be protected. theterriblevitrium gave an excellent answer to techniques, here are my 2 cents on that one.
- Anycast (For example, a CDN. This works incredibly well for static nodes such as local APIs, DNS servers and web servers, the downside with this is that it currently does not work effectively for systems that have a single point of failure such as game servers)
- Network rules & Packet Inspection (E.G. each connection can only take up X kb of traffic per second and each packet should match pattern x, y, or z. This worked well for our games. Downside is that if they hit your bandwidth limit, you're out of luck. )
Feel free to ask any questions!