Analyzing the CoAP DDoS Amplification Attack Ecosystem: A Honeypot Study

Abstract

DDoS amplification attacks exploit connectionless protocols to overwhelm victims
with traffic far exceeding the attacker's own bandwidth. The Constrained Application
Protocol (CoAP), designed for IoT devices, has emerged as an amplification vector
with over 1.7 million exposed reflectors and an amplification factor of approximately
34x, yet no prior work has studied CoAP amplification through honeypot-based
observation. We hypothesize that CoAP's extreme reflector instability - 80\% of
IP addresses change within two weeks - imposes a higher sophistication floor on
adversaries compared to previously studied protocols. To evaluate this, we deploy
the first CoAP-specific amplification honeypot with eight protocol configurations
testing blockwise transfer at four block sizes and rate limiting at three thresholds
across 18 IP addresses for 23 days. The scanning traffic reveals behaviors
undocumented in prior honeypot research: multi-phase CBOR fingerprinting that
distinguishes genuine Eclipse Californium devices from other implementations,
sustained reliability validation over repeated scanning cycles, and efficient list
management where probing ceases after device cataloguing. Notably, our honeypot was
likely filtered out after failing this fingerprinting test - a finding that
contrasts sharply with prior work on other protocols, where attackers were largely
indifferent to honeypot responses. No amplification attacks were observed, preventing
empirical evaluation of the tested defenses. However, our
findings provide the first evidence that CoAP's structural properties demand higher
adversary sophistication than previously studied amplification protocols, and suggest
that threat models for CoAP must account for fingerprinting-capable actors.