To carry out a DDoS attack, an attacker has at their disposal a large network of remotely controlled computers (BOTNET), so there is no longer a need to hide the IP address of each individual device (of course, a BOTNET can also be used to amplify regular DoS attacks). In this case, the attacker can simply mimic the actions of legitimate site users, but due to the large number of computers involved in the attack (sometimes hundreds of thousands), even such actions will generate heavy load on the site and lead to a denial of service. Typically, attackers select the most resource-intensive requests to the target site in order to minimize the number of participating computers whose IP addresses might be exposed after the attack.
Various behavioral strategies are often applied to mitigate such attacks with varying degrees of effectiveness, allowing deviations from normal behavior to be detected. Our approach is simple yet very effective — using a CAPTCHA page (Completely Automated Public Turing test to tell Computers and Humans Apart) — a computer test used to determine whether a user is human or a bot.
The protection works as follows: