Protection of Web Servers from DDoS Attacks Originating from the Tor Network: Detection and Mitigation Using Tor's Hammer
Stefan Ćirković, Saša Cvetković · 2025
Distributed Denial-of-Service (DDoS) attacks remain a serious threat to web servers, causing significant consequences. The Tor network, designed for privacy, is increasingly being exploited for launching DDoS attacks. This paper examines the challenges of detecting and mitigating DDoS attacks originating from the Tor network. It analyzes the characteristics of Tor that make it attractive to attackers, existing detection and mitigation methods, and the integration of protective mechanisms-rate limiting, iptables, and blocking Tor exit nodes-to reduce the impact of such attacks. The combination of these techniques for improved protection is considered, and their effectiveness in defending against Tor-based DDoS attacks is evaluated. It has been observed that many websites lack even basic defense mechanisms and that even fundamental DDoS protection can be beneficial.