A cybersecurity analyst is investigating an incident where an online retail website experienced a sudden surge in network traffic, causing service disruption. Upon inspection, the traffic primarily consisted of legitimate-looking HTTP GET requests sent in massive volumes. What type of Distributed Denial of Service (DDoS) attack is most likely being used in this scenario?

The scenario describes a massive volume of "legitimate-looking HTTP GET requests" overwhelming a web server. This is the defining characteristic of an HTTP Flood attack. This is an application-layer (Layer 7) Distributed Denial of Service (DDoS) attack that aims to exhaust server resources like CPU, memory, and database connections by forcing the application to process a high number of seemingly valid requests, leading to service disruption for legitimate users.

A. UDP Flood: This is a network/transport layer attack that uses a large volume of User Datagram Protocol (UDP) packets, not HTTP requests, to saturate the target's network bandwidth and resources.
C. SYN Flood: This transport-layer attack exploits the TCP three-way handshake by sending numerous SYN packets, consuming server resources by leaving many connections half-open, but it does not involve sending full HTTP requests.
D. Ping of Death: This is an older network-layer attack that involves sending a single malformed or oversized ICMP (ping) packet to crash a vulnerable system, not a flood of traffic.

1. Vendor Documentation: Cloudflare, Inc. "What is an HTTP flood attack?". Cloudflare Learning Center. Accessed 2023. In the section "How does an HTTP flood attack work?", it states, "HTTP flood attacks are a type of volumetric DDoS attack designed to overwhelm a targeted server with HTTP requests... the attacker bombards the server with HTTP requests... such as GET or POST requests."

2. Vendor Documentation: Amazon Web Services (AWS). "What Is a DDoS Attack?". AWS Documentation. Accessed 2023. Under the section "Application Layer Attacks (Layer 7)," it describes attacks like HTTP floods that "are composed of requests (e.g., HTTP GETs) that are designed to consume application resources."

3. Academic Publication: M. S. Z. Sarker, M. A. H. Khan, and M. M. Rahman, "A review on DDoS attack and defense mechanism," in 2018 International Conference on Advancement in Electrical and Electronic Engineering (ICAEEE), 2018, pp. 1-6. The paper classifies DDoS attacks and describes Application Layer attacks, stating, "HTTP flood is a type of application layer attack... The attacker exploits HTTP GET and POST requests to attack a web server or application." (Section III.A). DOI: 10.1109/ICAEEE.2018.8643009

4. University Courseware: Feamster, N., & Livingood, J. (2015). Computer Networks, A Systems Approach (Lecture Notes, Princeton University). Chapter 1: The Internet, Section 1.5.3 Denial of Service. The notes discuss application-level DDoS attacks, which include flooding a web server with seemingly legitimate requests, consistent with the mechanism of an HTTP Flood.