Efficient and low-cost hardware defense against DNS amplification attacks

GLOBECOM - IEEE Global Telecommunications Conference

Volumn , Issue , 2008, Pages 2062-2066

  Sun, Changhua ^a   Liu, Bin ^a   Shi, Lei ^a  

^a TSINGHUA UNIVERSITY   (China)

Author keywords

[No Author keywords available]

Indexed keywords

BANDWIDTH CONSUMPTION; BLOOM FILTERS; DNS SERVER; HARDWARE IMPLEMENTATIONS; IP ADDRESS; IP SPOOFING; MEMORY COST; QUERY MESSAGE; ROOT CAUSE; TRACE DRIVEN SIMULATION;

AMPLIFICATION; COMPUTER HARDWARE; HARDWARE; INTERNET SERVICE PROVIDERS; RECURSIVE FUNCTIONS; SERVERS;

INTERNET PROTOCOLS;

EID: 67249105817     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/GLOCOM.2008.ECP.397     Document Type: Conference Paper

References (27)

1. "CERT Advisory CA 1999-17, Denial-of-Service Tools," 1999. [Online]. Available: http://www.cert.org/advisories/CA-1999- 17.html
2. P. Mockapetris, "Domain names - concepts and facilities," RFC 1034, 1987. [Online]. Available: http://www.ietf.org/rfc/rfc1034.txt
3. P. Vixie, G. Sneeringer, and M. Schleifer, "Events of 21-Oct-2002," 2002. [Online]. Available: http://d.root-servers.org/ october21.txt
4. R. Lemos and J. Hu, "'Zombie' PCs caused Web outage, Akamai says," 2004. [Online]. Available: http://www.news.com/Zombie- PCs-caused- Web- outage-Akamai-says/2100-1038-3-5236403.html
5. "Factsheet: Root server attack on 6 February 2007," ICANN, 2007. [Online]. Available: http://www.icann.org/announcements/factsheet-dns- attack-08mar07.pdf
6. "SSAC Advisory SAC008 DNS Distributed Denial of Service(DDoS) Attacks," ICANN SSAC, 2006. [Online]. Available: http://www.icann.org/ committees/security/dns-ddos-advisory-31mar06.pdf
7. T. Hardie, "Distributing authoritative name servers via shared unicast addresses," RFC 3258, 2002. [Online]. Available: http://www.ietf.org/rfc/rfc3258.txt
8. S. Cheung, "Denial of service against the domain name system," IEEE Security & Privacy Magazine, vol. 4, no. 1, pp. 40-45, 2006.
9. G. Lawton, "Stronger domain name system thwarts root-server attacks," IEEE Computer, vol. 40, no. 5, pp. 14-17, May 2007.
10. R. Vaughn and G. Evron, "DNS amplification attacks," 2006. [Online]. Available: http://www.isotf.org/news/DNS-Amplification-Attacks.pdf
11. A. Broder and M. Mitzenmacher, "Network applications of Bloom filters: a survey," Internet Mathematics, vol. 1, no. 4, pp. 485-509, 2004.
12. "Know your enemy: tracking Botnets," 2005. [Online]. Available: http://honeynet.org/papers/bots/
13. P. Vixie, "Extension mechanisms for DNS (EDNS0)," RFC 2671, 1999. [Online]. Available: http://www.ietf.org/rfc/rfc2671.txt
14. "The measurement factory DNS survey," 2005. [Online]. Available: http://dns.measurement-factory.com/surveys/sum1.html
15. P. Ferguson and D. Senie, "Network ingress filtering: defeating denial of service attacks which employ IP source address spoofing," RFC 2827, 2000. [Online]. Available: http://www.ietf.org/rfc/rfc2827.txt
16. F. Baker and P. Savola, "Ingress filtering for multihomed networks," RFC 3704, 2004. [Online]. Available: http://www.ietf.org/rfc/ rfc3704.txt
17. R. Beverly and S. Bauer, "The spoofer project: inferring the extent of source address filtering on the Internet," in USENIX workshop on Steps to Reducing Unwanted Traffic on the Internet, July 2005.
18. P. Mockapetris, "Domain names - implementation and specification," RFC 1035, 1987. [Online]. Available: http://www.ietf.org/ rfc/rfc1035.txt
19. F. Guo, J. Chen, and T. Chiueh, "Spoof detection for preventing DoS attacks against DNS servers," in IEEE ICDCS, 2006, pp. 37-37.
20. G. Kambourakis, T. Moschos, D. Geneiatakis, and S. Gritzalis, "A fair solution to DNS amplification attacks," in International Workshop on Digital Forensics and Incident Analysis (WDFIA), 2007, pp. 38-47.
21. P. Dykstra, "Protocol overhead," 2003. [Online]. Available: http://sd.wareonearth.com/~phil/net/overhead/
22. C. Fraleigh et al., "Packet-level traffic measurements from the Sprint IP backbone," IEEE Network, vol. 17, no. 6, pp. 6-16, 2003.
23. "IP Data Analysis," Sprint academic research group. [Online]. Available: http://ipmon.sprint.com/packstat/packetoverview.php
24. J. Hao and D. Constantinos, "Passive estimation of TCP round-trip times," Comput. Commun. Rev., vol. 32, no. 3, pp. 75-88, 2002.
25. "Cypress Semiconductor." [Online]. Available: http://www.cypress.com
26. M. V. Ramakrishna, E. Fu, and E. Bahcekapili, "Efficient hardware hashing functions for high performance computers," IEEE Trans. Comput., vol. 46, no. 12, pp. 1378-1381, 1997.
27. "Abilene-V Trace Data," NLANR Project, 2004. [Online]. Available: http://pma.nlanr.net/Special/ipls5.html