John Heidemann / Papers / Defending Root DNS Servers Against DDoS Using Layered Defenses

Defending Root DNS Servers Against DDoS Using Layered Defenses
A S M Rizvi, Jelena Mirkovic, John Heidemann adn Wes Hardaker and Robert Story

Citation

A S M Rizvi, Jelena Mirkovic, John Heidemann adn Wes Hardaker and Robert Story. Defending Root DNS Servers Against DDoS Using Layered Defenses. Proceedings of the IEEE International Conference on Communications Systems and Netowrks (COMSNETS) (Bengaluru, India, Jan. 2023), to appear. [PDF] [alt PDF]

Abstract

Distributed Denial-of-Service (DDoS) attacks exhaust resources, leaving a server unavailable to legitimate clients. The Domain Name System (DNS) is a frequent target of DDoS attacks. Since DNS is a critical infrastructure service, protecting it from DoS is imperative. Many prior approaches have focused on specific filters or anti-spoofing techniques to protect generic services. DNS root nameservers are more challenging to protect, since they use fixed IP addresses, serve very diverse clients and requests, receive predominantly UDP traffic that can be spoofed, and must guarantee high quality of service. In this paper we propose a layered DDoS defense for DNS root nameservers. Our defense uses a library of defensive filters, which can be optimized for different attack types, with different levels of selectivity. We further propose a method that automatically and continuously evaluates and selects the best combination of filters throughout the attack. We show that this layered defense approach provides exceptional protection against all attack types using traces of real attacks from a DNS root nameserver. Our automated system can select the best defense within seconds and quickly reduce the traffic to the server within a manageable range while keeping collateral damage lower than 2%. We can handle millions of filtering rules without noticeable operational overhead.

Bibtex Citation

@inproceedings{Rizvi23a,
  author = {Rizvi, {A S M} and Mirkovic, Jelena and adn Wes Hardaker, John Heidemann and Story, Robert},
  title = {Defending Root {DNS} Servers Against {DDoS} Using Layered Defenses},
  booktitle = {Proceedings of the {IEEE} International Conference on Communications Systems and Netowrks (COMSNETS)},
  year = {2023},
  sortdate = {2023-01-03},
  project = {ant, ddidd, paaddos},
  jsubject = {network_security},
  note = {Awarded best paper},
  pages = {to appear},
  month = jan,
  address = {Bengaluru, India},
  publisher = {IEEE},
  jlocation = {johnh: pafile},
  keywords = {ddidd, ddos, filtering, frade},
  xdoi = {tbd},
  blogurl = {https://ant.isi.edu/blog/?p=1948},
  url = {https://ant.isi.edu/%7ejohnh/PAPERS/Rizvi23a.html},
  pdfurl = {https://ant.isi.edu/%7ejohnh/PAPERS/Rizvi23a.pdf}
}
Copyright © by John Heidemann