How do you tell a DDoS attack apart from a natural traffic spike?

Question

Accepted Answer

Both look like a sudden surge in requests, so you distinguish them by **the shape of the traffic, not just its volume**. A DDoS shows abnormal, machine-like patterns with no business reason; an organic spike follows real users and has a cause you can point to.

## Signs it is a DDoS

- **Concentration on one endpoint** — thousands of requests hammering a single expensive path (e.g. `/search` or `/login`) instead of spreading across the site.
- **Odd geographies and user agents** — traffic from regions you do not serve, or a single repeated/empty/forged `User-Agent`.
- **Low cache-hit ratio** — attackers craft unique query strings to bypass the CDN and hit your origin directly.
- **Malformed or repetitive requests** — identical payloads, missing headers, no cookies, no referrer chain.
- **No business driver** — no campaign, launch, or referral explains the surge, and it appears instantly rather than ramping up.

## Signs it is an organic spike

- **A traceable cause** — a marketing campaign, a viral post, a press mention, or a referral spike from a known source.
- **Normal user paths** — traffic flows through real journeys (landing -> product -> checkout), respects cache, and carries cookies and varied user agents.
- **A natural ramp** — load builds and tapers rather than snapping to a wall instantly.

## How to decide

Do not eyeball raw counts. **Maintain baselines** for requests-per-second, geo mix, cache-hit ratio, and error rate, then run **anomaly detection** against them.

```text
# Correlate several signals before declaring an attack:
requests/sec       -> spiked 20x        (suspicious)
cache-hit ratio    -> dropped 95% -> 5%  (bypassing cache = suspicious)
top endpoint       -> 90% to /login      (concentrated = suspicious)
conversions/signups-> flat or zero        (no business value = attack)
```

The tell is **correlation**: a real spike lifts business metrics too; an attack lifts cost while conversions stay flat.

## Why it matters

Misreading the two is expensive in both directions. Treating a launch surge as an attack and rate-limiting it blocks paying users; treating an attack as organic lets it exhaust your origin. Baselining plus correlated metrics lets you respond fast and correctly, which is the whole point of detection.