What is the name of the cyber attack in which an attacker overwhelms a web…

Concept — Attacks against a networked service fall into distinct families according to what the attacker does with traffic. Passive interception observes packets without changing them; name-resolution or routing manipulation redirects traffic; impersonation reuses credentials or session identifiers so a server treats the attacker as an authenticated user; reconnaissance gathers information about exposed services; and denial of service consumes capacity so legitimate users cannot be served. Within denial of service, network- or transport-layer floods target bandwidth or connection state, while application-layer floods send valid protocol requests that consume per-request processing resources.

Application — Here the attacker sends a very large number of HTTP requests until the web server can no longer cope. HTTP is an application-layer protocol and the requests are complete and well formed, so this is application-layer resource exhaustion, whose standard name is an HTTP flood or HTTP flooding. Each request that reaches the relevant server path consumes connection handling, parsing, routing or application-processing capacity; depending on the endpoint and intervening controls, it may also trigger database access or dynamic rendering. At sufficient volume, CPU, memory, worker pools or connection slots become unavailable to legitimate users. When requests come from many distributed sources, the same technique is an application-layer DDoS attack; a single-source flood is still a denial-of-service HTTP flood.

Cross-check — where each listed technique belongs

Note — DoS names the broad denial-of-service category. DDoS is its distributed form, which requires multiple attack sources. HTTP flooding is the specific application-layer or Layer 7 technique described here; among the offered names, HTTP Flooding is therefore the precise match.