A denial of service attack GCSE computer science definition: an attempt to make a website or server unavailable to its normal users by overwhelming it with far more traffic or requests than it can handle. Unlike SQL injection or brute-force attacks, a DoS attack does not steal data — it aims purely to disrupt access.
What is a denial-of-service attack?
A denial-of-service (DoS) attack floods a server, network or website with an overwhelming number of requests, using up its bandwidth, memory or processing power until it can no longer respond to genuine users. From the outside, the target simply appears to be down, slow, or "timing out" — even though nothing has technically been broken into or stolen.
Because the goal is disruption rather than theft, DoS attacks are used against organisations for reasons ranging from financial extortion (demanding payment to stop the attack) to activism or simple sabotage. GCSE specifications place DoS attacks alongside malware, phishing, brute-force attacks and SQL injection as key threats you must be able to describe and defend against.
How does a denial-of-service attack actually work?
A server can only handle a limited number of requests at once, based on its processing power, memory and network bandwidth. A DoS attack exploits this limit directly.
Worked example. A small online shop's server can comfortably process 200 requests per second from genuine customers. An attacker's script sends 50,000 fake requests per second to the shop's checkout page, all at once. The server tries to process every request in its queue, using up all its available processing power and memory on requests that will never complete properly. Real customers trying to check out at the same time find their requests simply queue behind the flood, time out, or the server crashes entirely.
The attack does not need to guess a password or find a coding flaw — it only needs to generate enough traffic that the target's capacity is exceeded. This is why DoS attacks are considered a threat even against otherwise well-secured systems.
What is the difference between a DoS attack and a DDoS attack?
The table below sets out the key distinction GCSE mark schemes look for.
| DoS (Denial of Service) | DDoS (Distributed Denial of Service) | |
|---|---|---|
| Number of attacking sources | One single computer | Many computers (often thousands), spread across different locations |
| Typical method | One machine sends a high volume of requests | A "botnet" of hijacked devices sends requests simultaneously |
| Ease of blocking | Easier — block the one source IP address | Much harder — traffic comes from thousands of different, often legitimate-looking, IP addresses |
| Scale of disruption | Limited by one machine's capacity | Far larger, since the traffic volume is shared across many machines |
A botnet — a network of malware-infected computers controlled remotely without their owners' knowledge — is the tool most commonly used to launch a DDoS attack, because it lets one attacker command thousands of machines to attack a single target at the same moment.
How can denial-of-service attacks be prevented or reduced?
No defence makes a server completely immune to a determined, large-scale DoS or DDoS attack, but several measures reduce the risk and limit the damage:
- Firewalls and traffic filtering — configured to detect and block suspicious patterns, such as an unusually high volume of requests from a single IP address.
- Rate limiting — restricting how many requests a single user or IP address can make in a given time period, so a flood of automated requests is throttled rather than processed in full.
- Load balancing — spreading incoming traffic across multiple servers, so no single machine is overwhelmed and normal users can still be served even under heavy load.
- Content delivery networks (CDNs) and anti-DDoS services — specialist services that absorb and filter huge volumes of traffic before it ever reaches the target server.
- Keeping software and devices patched — reduces the number of vulnerable, unprotected devices available to be recruited into a botnet in the first place.
Why do exam boards treat DoS attacks as a network security topic?
AQA and OCR both list denial-of-service attacks under the impact of networks and cyber security, because the attack specifically exploits how networks and servers handle traffic rather than exploiting weak passwords or unvalidated input. Exam questions commonly ask you to:
- Explain what happens to a server during a DoS attack, in terms of its resources being exhausted.
- Distinguish a DoS attack from a DDoS attack, usually by describing the number and distribution of attacking machines.
- Suggest an appropriate defence and justify why it would help, such as explaining how a firewall detects abnormal traffic volume.
Learning the "flood of requests exhausts a limited resource" idea covers almost every variation an exam board can ask, because DoS and DDoS attacks share that same underlying mechanism.
Frequently asked questions
What is a DoS attack in simple terms?
A DoS (denial-of-service) attack is an attempt to make a website, server or network unavailable to genuine users by flooding it with an overwhelming volume of traffic or requests. It does not steal data — its only goal is to disrupt normal access by exhausting the target's resources.
What is the difference between DoS and DDoS?
A DoS attack comes from a single computer, while a DDoS (Distributed Denial of Service) attack comes from many computers at once, usually a botnet of hijacked devices spread across different locations. DDoS attacks are harder to block because the traffic arrives from thousands of different IP addresses rather than one obvious source.
How does a denial of service attack actually work on a real server?
The attacker sends far more requests than the server can process at once, using up its bandwidth, memory or processing power until genuine users' requests time out or the server crashes. The server does not need any coding flaw or weak password for this to succeed — it only needs its normal request capacity to be overwhelmed.
Can a denial-of-service attack be stopped completely?
No defence guarantees complete immunity against a large, well-resourced DDoS attack, but firewalls, rate limiting, load balancing and specialist anti-DDoS services significantly reduce the risk and limit the disruption. Most organisations combine several of these measures rather than relying on just one.
Want a subject specialist to quiz you on network security threats until every answer is exam-ready? Add the AI Tutors connector at aitutors.me.