Malware-Driven DoS, SYN Flood, Reflection & Botnet Mechanics Explained

Malware such as viruses and worms can copy themselves to other applications and computers, delete files silently, generate network traffic without the user’s knowledge, harvest passwords via keyloggers, and encrypt data before deleting the original files. These actions can occur entirely in the background, making the victim unaware of the ongoing damage. Because the malicious program can also produce traffic, it can be a source of denial‑of‑service (DoS) or distributed denial‑of‑service (DDoS) attacks.

Denial of Service and Distributed Denial of Service

DoS and DDoS attacks target the “availability” pillar of security by overwhelming a server’s bandwidth or processing capacity. Infected machines, or bots, send a flood of packets that exceed the server’s limits, preventing legitimate users from accessing the service. The traffic is generated by malware under external control, so the victim’s computer may never see the attack originate from it.

SYN Flood Attack

A SYN flood exploits the TCP three‑way handshake (SYN, SYN‑ACK, ACK). When a SYN packet arrives, the server allocates a Transmission Control Block (TCB) – typically 250 to 1,000 bytes – to store the connection’s IP address and port. The attacker sends many SYN packets but never completes the handshake with the final ACK, causing the server to fill its TCB pool (e.g., 1,000 entries). Once the memory is exhausted, the server cannot accept new legitimate connections, resulting in a denial of service. This can be achieved with a single machine that can generate enough SYN packets.

Reflection and Amplification Attacks

In reflection attacks, malware sends spoofed requests to intermediate servers such as DNS or NTP, using the victim’s IP address as the source. Those servers, unaware of the spoofing, reply directly to the victim, reflecting the traffic. Amplification occurs when the reply is much larger than the request; for example, a 100‑byte request can trigger a 1,000‑byte response. This magnifies the attack volume while hiding the attacker’s identity and reducing the bandwidth each compromised host must provide.

Botnets and Command‑and‑Control

A botnet is a network of automated programs (bots) coordinated to perform malicious activities. While a bot itself is merely an automated task runner, a botnet can launch DDoS attacks, send spam, or steal data under the direction of a botmaster. Coordination is achieved through a Command‑and‑Control (C&C) infrastructure, which may be centralized (client‑server model) or distributed via peer‑to‑peer propagation. Robust C&C must handle churn—bots going offline or rebooting—and keep reaction time minimal. Common communication protocols include IRC and HTTP/Web traffic.