AWS said at re:Invent 2015 that about 15% of DDoS attacks on AWS were application layer [1]. Some were state exhaustion at 20% (SYN floods, etc.) but the vast majority (65%) were &quot;volumetric&quot; attacks, meaning layer three like DNS reflection and SSDP reflection.<p>[1] <a href="https:&#x2F;&#x2F;youtu.be&#x2F;Ys0gG1koqJA?t=172" rel="nofollow">https:&#x2F;&#x2F;youtu.be&#x2F;Ys0gG1koqJA?t=172</a>