TY - GEN
T1 - Preventing DNS amplification attacks using the history of DNS queries with SDN
AU - Kim, Soyoung
AU - Lee, Sora
AU - Cho, Geumhwan
AU - Ahmed, Muhammad Ejaz
AU - Jeong, Jaehoon Paul
AU - Kim, Hyoungshick
N1 - Publisher Copyright:
© 2017, Springer International Publishing AG.
PY - 2017
Y1 - 2017
N2 - Domain Name System (DNS) amplification attack is a sophisticated Distributed Denial of Service (DDoS) attack by sending a huge volume of DNS name lookup requests to open DNS servers with the source address spoofed as a victim host. However, from the point of view of an individual network resource such as DNS server and switch, it is not easy to mitigate such attacks because a distributed attack could be performed with multiple DNS servers and/or switches. To overcome this limitation, we propose a novel security framework using Software-Defined Networking (SDN) to store the history of DNS queries as an evidence to distinguish normal DNS responses from attack packets. Our evaluation results demonstrate that the network traffic for DNS amplification attack can completely be blocked under various network conditions without incurring a significant communication overhead.
AB - Domain Name System (DNS) amplification attack is a sophisticated Distributed Denial of Service (DDoS) attack by sending a huge volume of DNS name lookup requests to open DNS servers with the source address spoofed as a victim host. However, from the point of view of an individual network resource such as DNS server and switch, it is not easy to mitigate such attacks because a distributed attack could be performed with multiple DNS servers and/or switches. To overcome this limitation, we propose a novel security framework using Software-Defined Networking (SDN) to store the history of DNS queries as an evidence to distinguish normal DNS responses from attack packets. Our evaluation results demonstrate that the network traffic for DNS amplification attack can completely be blocked under various network conditions without incurring a significant communication overhead.
KW - Distributed Denial of Service (DDoS)
KW - DNS amplification attack
KW - Domain Name System (DNS)
KW - Software-Defined Networking (SDN)
UR - https://www.scopus.com/pages/publications/85029479554
U2 - 10.1007/978-3-319-66399-9_8
DO - 10.1007/978-3-319-66399-9_8
M3 - Conference contribution
AN - SCOPUS:85029479554
SN - 9783319663982
T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
SP - 135
EP - 152
BT - Computer Security – ESORICS 2017 - 22nd European Symposium on Research in Computer Security, Proceedings
A2 - Foley, Simon N.
A2 - Gollmann, Dieter
A2 - Snekkenes, Einar
PB - Springer Verlag
T2 - 22nd European Symposium on Research in Computer Security, ESORICS 2017
Y2 - 11 September 2017 through 15 September 2017
ER -