Kaspersky Lab's DDoS trends report: number of DDoS attacks dropped 13% YoY in 2018, but the average duration of attacks grew from 95 min in Q1 to 218 min in Q4
News overview — In Q4 2018, security researchers detected a number of new botnets, which included not only Mirai clones for a change.
Context & Ripple Effects
The DDoS story has inverted since Verisign's Q4 2015 report of an 85% year-on-year surge in attacks: Kaspersky Lab now counts 13% fewer attacks across 2018, but each one lasts far longer — average duration climbed from 95 minutes in Q1 to 218 by Q4. Volume was the headline metric three years ago; persistence is the metric now.
The botnet side explains part of the shift. Mirai's descendants have stayed active well past their debut — they were still being repurposed in 2017 to DDoS the domain hardcoded into WannaCry's kill-switch — and Kaspersky's researchers saw fresh botnet families appear in Q4 2018 that were not simply Mirai clones, suggesting the attack-supply base is diversifying even as attack counts fall.
First-order effects
- Organizations hit by DDoS in late 2018 faced outages more than twice as long as those earlier in the year, so the cost of a single successful attack rose even as the odds of being attacked fell.
- Kaspersky Lab's telemetry now has to weight duration and botnet composition, not just counts, when characterizing the threat landscape for customers.
Second-order effects
- With fewer attacks competing for attention, botnet operators appear to be differentiating on staying power and new codebases rather than raw volume — pushing rivals toward longer, more sophisticated campaigns instead of spray-and-pray floods.
- Mitigation vendors and hosting providers face pressure to price and staff against sustained multi-hour sieges rather than short bursts, changing what their service-level commitments need to cover.
Third-order effects
- If the pattern holds, DDoS matures from a numbers game into a persistence game: success metrics shift from attacks blocked to downtime prevented, and the market consolidates around defenders who can absorb long-duration pressure.
- A diversifying botnet supply — new families alongside the long-lived Mirai line — points toward an entrenched, renewable attack infrastructure that outlives any single malware takedown.
The trend: DDoS activity is shifting from rising attack volumes toward fewer but longer, more persistent campaigns run on an increasingly diverse botnet base.