DDoS attacks in the age of AI and automation

Distributed Denial-of-Service (DDoS) attacks have evolved dramatically. With the rise of AI chatbots, growing adoption of cloud infrastructure and automation tools, attackers now have access to powerful resources to cripple digital services. Large-scale botnets are readily available, even to those with minimal technical skills. 

In fact: 

• Both the frequency and scale of DDoS attacks are increasing 
• Attack-as-a-service platforms make launching attacks easy and cheap, even for low-skill attackers. 
• In Switzerland, financial institutions and critical infrastructure providers have seen a rise in DDoS-related extortion attempts. 

In 2025, DDoS attacks remain a serious threat. The National Cyber Security Centre (NCSC) reports multiple attacks in the past years, their latest report dating back to March 2025.  

 

Attack type: Application-Layer DDoS (HTTP) 

Today’s web applications operate on the application layer. And that’s precisely where modern DDoS attacks strike. Attackers don’t need massive bandwidth to disrupt a web application’s availability – they achieve it by leveraging a distributed network of devices to simulate legitimate user behavior: browsing pages, submitting forms, or requesting dynamic content. These harmless looking requests make it harder to distinguish malicious from legitimate traffic. This is a commonly observed attack pattern for volumetric attacks.  

Since such attacks may originate from all over the world, strict Geo-IP filtering is not a silver bullet. It reduces the exposure but cannot fully prevent such threats.  

Most DDoS attacks are performed in less than 15 minutes. This underlines the importance of early detection, tight rate-limiting thresholds and proactive preventive measures. 

 

Building DDoS resilience with Airlock Gateway 

Airlock Gateway provides multiple protection layers to detect, mitigate and block modern DDoS attacks efficiently.  

Key features include: 

• Rate Limiting with DoS Attack Prevention: Controls access at the application layer (see documentation) 
• Dynamic IP Blocking: Repeated requests from known malicious IP addresses are automatically blocked once a defined threshold is reached. 
• Geolocation Filtering: Restricts access from selected regions 
• Anomaly Shield: Detects abnormal and more sophisticated attack patterns 
• Logging & Monitoring: Analyses ongoing attacks  

We also provide custom Kibana dashboards to support web traffic analysis and define baseline thresholds for rate limiting: