DDoS Attack Simulation for a Major Financial Institution: SkyCloud Successfully Passes Financial-Grade Defense Validation | Case Study

Background and Objectives of the Drill

As the government continues to strengthen cybersecurity resilience in the financial sector and impose more rigorous stress-testing requirements, financial institutions must conduct high-intensity cybersecurity drills regularly to verify that critical services remain stable and available under real-world attack scenarios.

This case involved a financial cybersecurity drill organized by a major financial institution in the second half of 2025. The institution had already established a comprehensive on-premises protection architecture and adopted cloud-based security services from internationally renowned providers, demonstrating a high level of overall defense maturity. In addition to validating its existing defense mechanisms, the drill aimed to further assess the effectiveness and feasibility of locally provided security services in real-world financial environments.

SkyCloud was invited to participate in the drill and integrated into the existing cloud and on-premises collaborative defense architecture, where it handled a portion of the attack traffic to validate its Anti-DDoS protection capabilities.

Drill Objectives and Attack Challenges

This financial cybersecurity drill was not simply a test of bandwidth capacity. Instead, it simulated high-risk attack patterns that have increasingly appeared in the financial industry in recent years, with particular emphasis on techniques that traditional defense mechanisms may struggle to identify and block in real time.

The simulated attack scenarios included:

• Resource-exhaustion Slow (SHA) attacks

• Resource-exhaustion HTTP application-layer attacks (simulating the NoName057 attack pattern)

• Resource-exhaustion DNS attacks (100,000 QPS)

• Bandwidth-exhaustion DDoS attacks (Layer 3 / Layer 4) at 10 Gbps

Among these, slow-rate and application-layer attacks use low-frequency requests and long-lived connections to continuously consume system resources. These are among the most disruptive attack types in real-world scenarios today, as they can easily bypass traditional defenses and pose a significant threat to the availability of financial services.

SkyCloud's Defense Architecture and Role in the Drill

The financial institution adopted a cloud and on-premises collaborative defense model for this drill. The final traffic route depended on the NS records to which users' DNS queries were resolved. SkyCloud deployed its CDN and scrubbing center architecture in coordination with the existing international cloud-based protection services, handling and mitigating a portion of the attack traffic.

This approach allowed the financial institution to evaluate SkyCloud's protection performance and real-time response capabilities in an actual financial environment without compromising the stability of its existing services.

Three-Layer Traffic Scrubbing Architecture | Comprehensive Protection Against Slow-Rate and Hybrid Attacks

During the drill, SkyCloud put its independently developed three-layer traffic scrubbing architecture to the test, applying different levels of protection to block attacks at each layer:

Layer 1 | International Cloud-Based Edge Scrubbing
Through partnerships with internationally renowned cloud security providers, large-scale and clearly abnormal traffic is intercepted in real time at global edge nodes, completing the first stage of traffic scrubbing.

Layer 2 | SkyCloud's Proprietary Scrubbing Centers
Scrubbing centers located in Taiwan, Japan, Singapore, Hong Kong, and Los Angeles use the Turbo Filter mechanism to perform behavioral analysis and multi-layer deep filtering. This effectively addresses defense gaps in single-cloud protection against slow-rate and hybrid attacks.

Layer 3 | Application-Layer WAF Protection
For Layer 7 CC and application-layer attacks, the latest WAF and challenge-response verification mechanisms help ensure that websites maintain high availability and a stable user experience throughout an attack.

Through the coordinated operation of all three layers, the proportion of malicious traffic reaching the origin server was significantly reduced, successfully preventing the risk of origin server resource exhaustion.

Overview of Defense Results

During the two-hour high-intensity, unannounced drill, SkyCloud's defense system successfully intercepted multiple types of attack traffic, keeping services fully operational throughout the exercise.

Overall performance and key defense results:

• Peak attack traffic: 4.08 Gbps

• Actual traffic reaching the origin server after scrubbing: 5.64 Mb/s

• Overall traffic scrubbing efficiency: 99.86%

• Service availability during the drill: 100%, with services operating normally throughout

The drill was conducted on a production website while normal user traffic and monitoring traffic continued to flow simultaneously. Traffic reaching the origin server remained within a reasonable range and placed no significant strain on the server.

▲ Maximum number of concurrent connections during the drill: 5,890

▲ Traffic acceptance and origin routing policy adjustments

Drill Results and Practical Observations

The financial cybersecurity drill provided a clear comparison of how different defense architectures performed against slow-rate and application-layer attacks.

SkyCloud's multi-layer traffic scrubbing architecture effectively handles low-frequency, long-lived connection attacks, demonstrating that an effective defense strategy must do more than simply block malicious traffic—it must also protect the system's underlying resources.

Following the drill, the financial institution recognized that SkyCloud's defense performance showed no significant difference from that of internationally renowned cloud security providers in practical testing. It also acknowledged SkyCloud's advantages in cost-effectiveness, policy flexibility, and local support. The institution is now further evaluating the possibility of incorporating SkyCloud into its official cloud and on-premises collaborative defense architecture.

Conclusion

Financial cybersecurity drills cannot fully replicate the sudden, large-scale attacks that occur in the real world. However, every exercise provides a practical assessment of an organization's defense architecture, decision-making processes, and overall resilience.

With extensive experience in real-world financial cybersecurity scenarios, SkyCloud continues to help financial institutions and enterprises in Taiwan establish practical, sustainable cybersecurity defenses against increasingly complex and unpredictable DDoS threats.

Technical Summary / Additional Data

Three-Layer Traffic Scrubbing Performance

※ The drill was conducted on a production website. Normal user visits and monitoring probes continued during the exercise, so some traffic reaching the origin server was expected.

CPU Utilization

• Peak utilization: 26.4%

• Overall CPU load remained at a low to moderate level, with sufficient capacity to handle additional concurrent connections.

Memory Utilization (Mem)

• Average utilization: 22%

• Memory consumption remained stable, with no significant resource pressure or anomalies.