Abstract:Domain Name System (DNS) amplification attacks exploit botnets and open recursive DNS servers to launch Distributed Denial of Service (DDoS) attacks. During an attack, the attacker leverages infected computers (bots) to perpetually send small spoofed DNS queries to numerous open recursive DNS servers. The servers, in turn, respond with lots of large DNS responses, which are reflected back to the victim. Such responses are usually several times larger than the original queries, and could exhaust the resources of CPUs, memory, and network bandwidth, rendering them unavailable for benign users. However, most in-network DDoS mitigation systems today inevitably cause normal DNS responses to be discarded while scrubbing traffic, as they do not distinguish between legitimate and malicious responses. To address this issue, some existing solutions employ Bloom filters to filter out unsolicited DNS responses, utilizing the "one-to-one mapping" relationship between DNS queries and responses. In this work, we present a framework called DAmpADF, designed to defend against DNS amplification attacks. The framework employs Bloom filters at the edge or core routers of Internet Service Providers (ISPs) or organizations to filter out malicious DNS responses. To reduce the false positives of the Bloom filters, we propose a novel data structure called the Non-amplifier Keeper (NAmpKeeper), which maintains the most frequently queried DNS servers that are not DNS amplifiers. By excluding queries to non-amplifiers from the Bloom filters, the false positives of Bloom filters are decreased significantly. Experimental results show that DAmpADF outperforms previous methods and achieves a superior filtration ratio of illegitimate DNS responses. Furthermore, the proposed approach incurs small, constant processing and memory overhead, enabling support for high line rates.

Improved Defense Against Domain Name Server Man-In-The-Middle Spoofing

Detection Method of Domain Names Generated by DGAs Based on Semantic Representation and Deep Neural Network

Adaptive IP Mutation: A Proactive Approach for Defending against Worm Propagation

Stars Can Tell: A Robust Method to Defend Against GPS Spoofing Attacks Using Off-the-shelf Chipset.

An intelligent proactive defense against the client‐side DNS cache poisoning attack via self‐checking deep reinforcement learning

A Method Based on AMHI for DDoS Attacks Detection and Defense

The Maginot Line: Attacking the Boundary of DNS Caching Protection

DAmpADF: A framework for DNS amplification attack defense based on Bloom filters and NAmpKeeper

A Distributed IP Spoof Detection System in Intranet

DNS Cache Poisoning Attack Reloaded: Revolutions with Side Channels

HinDom: A Robust Malicious Domain Detection System based on Heterogeneous Information Network with Transductive Classification

Unilateral Antidotes to DNS Cache Poisoning

A wrinkle in time: A case study in DNS poisoning

A Lightweight Double-Stage Scheme to Identify Malicious DNS over HTTPS Traffic Using a Hybrid Learning Approach

DNSGuard: In-network Defense Against DNS Attacks

Countering Malicious Processes with Process-DNS Association.

Anti-Attacking Modeling and Analysis of Cyberspace Mimic DNS

Preventing DNS Misuse for Reflection / Amplification Attacks With Minimal Computational Overhead on the Internet

DNS Typo-squatting Domain Detection: A Data Analytics & Machine Learning Based Approach

Intelligent model for the detection and classification of encrypted network traffic in cloud infrastructure

Malicious DNS detection by combining improved transformer and CNN