Abstract:Domain Name System (DNS) amplification attacks exploit botnets and open recursive DNS servers to launch Distributed Denial of Service (DDoS) attacks. During an attack, the attacker leverages infected computers (bots) to perpetually send small spoofed DNS queries to numerous open recursive DNS servers. The servers, in turn, respond with lots of large DNS responses, which are reflected back to the victim. Such responses are usually several times larger than the original queries, and could exhaust the resources of CPUs, memory, and network bandwidth, rendering them unavailable for benign users. However, most in-network DDoS mitigation systems today inevitably cause normal DNS responses to be discarded while scrubbing traffic, as they do not distinguish between legitimate and malicious responses. To address this issue, some existing solutions employ Bloom filters to filter out unsolicited DNS responses, utilizing the "one-to-one mapping" relationship between DNS queries and responses. In this work, we present a framework called DAmpADF, designed to defend against DNS amplification attacks. The framework employs Bloom filters at the edge or core routers of Internet Service Providers (ISPs) or organizations to filter out malicious DNS responses. To reduce the false positives of the Bloom filters, we propose a novel data structure called the Non-amplifier Keeper (NAmpKeeper), which maintains the most frequently queried DNS servers that are not DNS amplifiers. By excluding queries to non-amplifiers from the Bloom filters, the false positives of Bloom filters are decreased significantly. Experimental results show that DAmpADF outperforms previous methods and achieves a superior filtration ratio of illegitimate DNS responses. Furthermore, the proposed approach incurs small, constant processing and memory overhead, enabling support for high line rates.

Large-scale empirical evaluation of DNS and SSDP amplification attacks

Countering DNS Amplification Attacks Based on Analysis of Outgoing Traffic

The best bang for the byte: Characterizing the potential of DNS amplification attacks

Fingerprinting Internet DNS Amplification DDoS Activities

The Age of DDoScovery: An Empirical Comparison of Industry and Academic DDoS Assessments

DAmpADF: A framework for DNS amplification attack defense based on Bloom filters and NAmpKeeper

Preventing DNS Amplification Attacks Using the History of DNS Queries with SDN

The store-and-flood distributed reflective denial of service attack

TsuKing: Coordinating DNS Resolvers and Queries into Potent DoS Amplifiers

DNSBomb: A New Practical-and-Powerful Pulsing DoS Attack Exploiting DNS Queries-and-Responses

Preventing DNS Misuse for Reflection / Amplification Attacks With Minimal Computational Overhead on the Internet

DNS Amplification Attacks: Obsolete or Potent Threats?

Efficient and Low-Cost Hardware Defense Against DNS Amplification Attacks

SF-DRDoS: the Store-and-flood Distributed Reflective Denial of Service Attack.

DDoSMiner: an Automated Framework for DDoS Attack Characterization and Vulnerability Mining.

Monitoring Security of Enterprise Hosts via DNS Data Analysis

A Broad Learning-Based Comprehensive Defence Against SSDP Reflection Attacks in IoTs

SoK: A Data-driven View on Methods to Detect Reflective Amplification DDoS Attacks Using Honeypots

TSA: A Two-Phase Scheme Against Amplification DDoS Attack in SDN.

20 Years of DDoS: a Call to Action

Mining IP to Domain Name Interactions to Detect DNS Flood Attacks on Recursive DNS Servers