Traffic Filtering Technologies in DDoS Protection

DDoS (distributed denial-of-service) attacks are becoming increasingly diverse. The classic approach is to overwhelm a network link with junk traffic. However, attackers can also use more sophisticated techniques, such as disguising malicious traffic as legitimate requests in application-layer (L7) attacks or combining multiple attack vectors across different layers of the OSI model. AI has also entered the picture, enabling attackers to train bots and adapt their tactics in real time.

According to StormWall, 19.4 million DDoS attacks were mitigated in 2025, a 198% increase over the previous year. In 2026, individual attacks often exceed 2 Tbps in traffic volume.  Attack tools are sold under the DDoS-as-a-Service model.

Without professional protection, defending against DDoS attacks is becoming increasingly difficult and, in many cases, impossible. How does a cloud-based DDoS protection service work? What happens to traffic inside a provider’s scrubbing center? In this article, we take a closer look at the technologies that make traffic filtering effective. 

TL;DR

In DDoS protection, incoming traffic filtering involves analyzing traffic across different layers of the OSI model to distinguish legitimate traffic from malicious ones. DDoS traffic filtering involves multilevel analysis of network-, transport-, and, where necessary, application-layer parameters. Legitimate requests are forwarded to servers with minimal latency. Anomalous packets, attack-specific packets, reflection and amplification traffic, and junk requests are filtered out. 

Cloud-based DDoS protection solutions act as a protective layer in front of the customer’s infrastructure: traffic does not travel directly to the customer’s servers but passes through the provider’s distributed network. This architecture differs fundamentally from deploying appliances at the network perimeter: when an attack reaches hundreds of gigabits per second, the network link can become saturated before local equipment has time to respond.

Always-On and On-Demand Protection

DDoS protection can operate in two modes:

1. Always-on protection — all traffic continuously passes through the provider’s infrastructure, so filtering is already in place when an attack begins. 
2. On-demand protection — under normal conditions, traffic travels directly to the customer’s infrastructure, and redirection is activated when an attack is detected. Switching can be performed manually or automatically. In automatic mode, a DDoS sensor detects when attack traffic exceeds a predefined threshold within the customer’s network.

On-demand protection is more cost-effective but requires additional monitoring resources. The time needed to switch traffic depends on the redirection mechanism and routing or DNS settings. This can take anywhere from 30 seconds to 15 minutes. In some cases, this means the initial stages of an attack may go undetected or unmitigated. 

The choice of protection mode depends on how critical the service is and how much delay it can tolerate before protection is activated. Payment systems and online games typically use always-on protection. On-demand protection may be sufficient for less critical resources that are rarely attacked, or for resources where only a small subset of IP prefixes needs protection. It can also serve as a backup DDoS protection service, activated during particularly powerful attacks or when the primary provider is performing maintenance. 

How Traffic Is Redirected to a Scrubbing Center

Two common methods are used to redirect traffic to a scrubbing center.

1. BGP announcements. 

BGP allows an IP prefix to be announced so that traffic is routed through the protection provider’s infrastructure, making it suitable for network-layer protection. After filtering, clean traffic is delivered to the customer’s resources through a GRE tunnel or a dedicated link.

In scrubbing networks, BGP is often used together with anycast routing, which allows the same prefix to be announced from multiple points of presence (PoPs) in different geographic locations. Each user is routed to the nearest node, so when an attack occurs, traffic can be scrubbed at that location.

2. DNS-based redirection. 

The customer changes the domain’s A record to an IP address provided by the protection provider or delegates the domain to the provider’s name servers (NS). After this change, traffic passes through the provider’s cloud-based filtering infrastructure. This method is easier to deploy, but managing a large number of domains can be more complex. However, it does not provide full protection if the origin IP address can be discovered and attacked directly. 

Key Traffic Filtering Modules

The platform’s architecture and traffic processing sequence depend on the provider. A typical multilevel scrubbing setup includes several functional modules, each designed to handle specific tasks.

Module	Function	Attacks Mitigated
L3-L4 filtering (network and transport layers)	Applies rules based on protocols, ports, packet sizes, and source geolocation; limits packet and connection rates (rate limiting); uses access control lists (ACLs); and blocks networks with a poor reputation.	Volumetric floods that overwhelm networks with junk packets, including UDP and ICMP floods, and amplification attacks.
Deep packet inspection (DPI)	Inspects packet structure and checks protocol compliance, including application-layer data where available.	Malformed SYN packets, invalid HTTP requests, and oversized DNS responses that violate protocol standards.
Behavioral analysis and machine learning	Builds profiles of normal traffic based on factors such as source geolocation, autonomous systems, session characteristics, and request frequency. Detects deviations from historical traffic patterns.	Previously unknown attack vectors and L7 attacks designed to mimic legitimate traffic.
Challenge-response verification	At the network layer, a SYN proxy verifies TCP connection establishment. At the application layer, JavaScript challenges assess HTTP client behavior.	SYN floods and bot-driven application-layer attacks.
Clean traffic delivery	Returns filtered traffic to the customer through GRE or ZeroNAT tunnels, dedicated links, or direct traffic exchange with network operators (peering).	—
Management portal and API	Provides real-time charts, blocking logs, and integration with the customer’s monitoring systems.	—

The challenge-response module deserves a closer look. The scrubbing center completes the TCP handshake with the client and establishes a separate connection to the origin server only after the client successfully passes verification. These checks can filter out some automated traffic. However, modern bots can emulate browser behavior, so challenges are usually combined with other signals. Legitimate users typically do not notice the verification process.

From Signature-Based Filtering to Adaptive Platforms

Over the past several years, scrubbing centers have evolved from signature-based systems into adaptive platforms. Three developments have played a major role in this shift:

1. Machine learning. Applied to network telemetry, it analyzes not just individual packets but also traffic patterns, including source-group behavior, time series, and correlations between traffic flows. Filtering rules adapt automatically as an attack’s characteristics change and are then refined or disabled when the attack ends.
2. Adaptive filtering rules. Rules are updated automatically during an attack. The system builds a profile of the attack traffic and creates temporary blocking rules. These remain active only as long as necessary and are designed to avoid affecting legitimate users with similar traffic characteristics.
3. Global threat intelligence. Its databases contain extensive attack data, including publicly available information and data collected by providers over years of operation. This information complements behavioral analysis. Known malicious IP addresses, networks, autonomous systems, and other indicators are taken into account when making blocking decisions.

StormWall’s Proprietary Traffic Filtering Technologies

Many DDoS protection providers also develop proprietary technologies. Our solutions include the following technologies:

• Triple Filter (three-stage traffic cleaning). Traffic passes through three filtering points on its way to the server. Edge routers protect against volumetric attacks and TCP/UDP amplification. Hardware filters process the bulk of TCP/UDP flood traffic at high speed. Stateful filters block the most sophisticated DDoS attacks, including botnet-driven attacks.
• BanHammer: HTTP Flood Protection. At the application layer, BanHammer provides additional protection through behavioral and signature-based traffic analysis. This helps minimize false positives while blocking as many malicious requests as possible.
• StormFlow analyzes data flows, detects anomalies, and automatically adjusts protection parameters through BGP FlowSpec (RFC 5575) and our system’s API. This enables precise responses to DDoS attacks.
• SpeedRoute. Traffic travels from the nearest filtering point to the server over dedicated links between data centers. This reduces ping, keeps latency stable, and protects against traffic shaping.
• Global Session (preserving active sessions). If a filtering node experiences a technical issue or fails, the user’s connection remains active. Traffic is automatically redirected to the nearest available node in the network.
• HyperCache (accelerated content delivery). Large static files are cached directly in the scrubbing servers’ RAM, reducing the load on the origin server and improving response times for users. 

How Traffic Filtering Works During an Attack

Let’s look at two common scenarios for traffic filtering.

1. DNS Amplification over UDP

An attacker crafts DNS queries, spoofs the source IP address to make it appear to belong to the victim, and sends the queries to thousands of open DNS resolvers. These servers return much larger responses, with amplification factors of 50x or more.

At the scrubbing center’s network edge, the system detects an abnormal increase in UDP traffic to port 53, arriving simultaneously from hundreds of thousands of sources.

The L3–L4 filter limits the traffic rate and blocks abnormally large UDP responses, while behavioral analysis confirms that the traffic deviates from its historical profile. Within seconds, most of the attack traffic is filtered at the network edge, and only legitimate traffic reaches the customer’s servers. 

2. SYN Flood

An attacker generates a large number of TCP SYN packets and may use spoofed source IP addresses. The victim’s server waits for responses that never arrive. As a result, the table of half-open connections fills up and server resources become exhausted.

The scrubbing center intercepts all TCP traffic and acts as a SYN proxy. A connection to the origin server is established only after the client passes verification. For a bot, this is a dead end; for a legitimate user, it adds only a few milliseconds of latency — too little to notice.

How DDoS Protection Works With Other Security Layers

Traffic scrubbing is an important layer of protection, but it is not the only one. A security architecture can include several additional components.

A WAF (Web Application Firewall) protects against application-layer attacks, including injection attacks, vulnerability exploitation, and attacks targeting application logic. While traffic scrubbing detects anomalous HTTP traffic patterns, a WAF inspects individual requests and blocks specific threats.

Antibot identifies automated threats using a combination of signals, including device and browser characteristics and user behavior.

A CDN (Content Delivery Network) caches static content, reduces the load on the origin server, and can also help filter malicious traffic.

Event logs and telemetry complete the feedback loop. Data on blocked attacks is sent to a SIEM (Security Information and Event Management) system, where it is organized into structured intelligence about attack characteristics, sources, and vectors.

Why Provider Expertise Matters

Provider expertise is equally important. Attacks continue to evolve: new amplification vectors emerge, botnet tools change, and attackers become increasingly sophisticated at mimicking legitimate application-layer traffic.

Effective incoming traffic filtering requires specialized expertise, continuous threat monitoring, and ongoing adaptation. This is what distinguishes a full-fledged DDoS protection service from a solution that is configured once and then left without ongoing maintenance.

If you want to find out whether your infrastructure can withstand an attack, contact us. We’ll help you choose the most suitable protection architecture.

Author: Yulia Ilyina, Technical Expert, StormWall