What is Application DoS; how does it differ from volumetric DDoS?

Short answer

Application DoS is an attack that exhausts a service not with traffic volume but with a relatively small number of requests that trigger expensive operations in the application: for example, requests that send their headers very slowly, compressed content that grows excessively when decompressed or XML content that expands in nested layers, inputs that lead to ReDoS, and queries that consume resources (CWE-400, OWASP DoS Cheat Sheet). Volumetric DDoS, on the other hand, fills the bandwidth, the connection tables or the request capacity with a large number of packets or requests; Application DoS can stay below the volume limits. In TR7, the two types are countered by different layers: volume-based attacks by L4 DDoS Protection and L7 DDoS Protection; Application DoS patterns by the built-in Signature & Rule Library in WAF, with its Application DoS category (33 rules), and by the size, count and depth limits in the page types (Path Check Fields); and headers sent slowly by the Timeouts profile's HTTP Request Timeout (default 30 s).

Where It Is Used in TR7

Where	Field / label	What for
Configuration Menu → WAF → Signature & Rule Library; the OWASP Rules screen of the vService	The Signature Category column (hidden by default); Filter → Signature Categories → Application DoS	Listing the rules that look for patterns such as decompression bomb, ReDoS and XML entity expansion
vService → WAF Management → WAF Rules → page type → Path, Query, Header, Form, JSON, Xml, Raw tabs	Size, length, count and depth fields (Path Check Fields); they are listed in Signature & Rule Library under the Structure Limits category	Limiting resource consumption by excessively large or deeply nested inputs
Configuration Menu → Load Balancer → Profiles → Timeouts	HTTP Request Timeout (default 30 s)	The time allowed for the request line and the headers to be completed; on a WAF-enabled vService while Wait for Body for a Time is not checked, or while Debug Mode is on, receiving the body is also included in this time; it cuts off clients that send their headers slowly
Left Monitor Panel → Bot/DDoS Protected vServices → vService → Bot/DDoS Management	The L7 DDoS Protection card	Limiting the request and connection volume coming to the vService
Left Monitor Panel → Route Tables & L4 DDoS → route table → L4 DDoS Management	TCP, UDP, ICMP & Reflection, Packet Integrity bands	Flood rules at the packet and connection level
WAF Event Logs	The Category tab on the filter strip → Application DoS or Structure Limits	Seeing the requests caught by these patterns

• The time allotted to the WAF scan of a request is limited to 2 seconds; for a request that tries to prolong the scan, WAF does not run longer than this time. In a group in Blocking Mode, a request that cannot be completed within the time is blocked (if Fail-open is on, it is passed without being scanned): What happens to a request if the scan exceeds a certain time (2-second scan limit)?
• The division of labor between WAF and L7 DDoS protection: What is the difference between WAF and L7 DDoS & Threat Protection; do I need both?

Difference from Volumetric DDoS

	Application DoS	Volumetric DDoS
Method	Relatively few requests that trigger expensive operations	A large number of packets or requests
What it consumes	CPU, memory, threads, open connection time	Bandwidth, connection table, request capacity
Volume limits	Can stay below them	They are its direct target
Countered in TR7 by	WAF signatures and structural limits, Timeouts profile	L4 DDoS Protection and L7 DDoS Protection
Details	This page	What is a DDoS attack; at which layers does TR7 provide DDoS protection?

Common Misconceptions

• "A volume limit stops Application DoS as well." A small number of expensive requests can stay below the limits; these requests are countered with content and time limits.
• "Only large attacks bring a service down." Even a single expensive request (e.g. an input that leads to ReDoS) can keep the server busy for a long time.
• "Application DoS and DDoS exclude each other." Expensive requests can also be sent from many sources; in this case, the protections of the two layers work together.

How it is done in the documentation

• Signature & Rule Library · Signature Categories
• Path Check Fields · The Tabs and the Section They Inspect
• Timeouts · HTTP Request Timeout
• L7 DDoS Protection

Related questions

• What is a DDoS attack; at which layers does TR7 provide DDoS protection?
• What is the difference between WAF and L7 DDoS & Threat Protection; do I need both?
• What is an XXE (XML External Entity) attack?