Defending Root DNS Servers Against DDoS Using Layered Defenses

Rizvi, A S M and Mirkovic, Jelena and Heidemann, John and Hardaker, Wes and Story, Robert

citation

A S M Rizvi, Jelena Mirkovic, John Heidemann, Wes Hardaker and Robert Story 2023. Defending Root DNS Servers Against DDoS Using Layered Defenses. Proceedings of the IEEE International Conference on Communications Systems and Networks (COMSNETS) (Bengaluru, India, Jan. 2023), to appear. [PDF]

abstract

Distributed Denial-of-Service (DDoS) attacks exhaust resources, leaving a server unavailable to legitimate clients. The Domain Name System (DNS) is a frequent target of DDoS attacks. Since DNS is a critical infrastructure service, protecting it from DoS is imperative. Many prior approaches have focused on specific filters or anti-spoofing techniques to protect generic services. DNS root nameservers are more challenging to protect, since they use fixed IP addresses, serve very diverse clients and requests, receive predominantly UDP traffic that can be spoofed, and must guarantee high quality of service. In this paper we propose a layered DDoS defense for DNS root nameservers. Our defense uses a library of defensive filters, which can be optimized for different attack types, with different levels of selectivity. We further propose a method that automatically and continuously evaluates and selects the best combination of filters throughout the attack. We show that this layered defense approach provides exceptional protection against all attack types using traces of real attacks from a DNS root nameserver. Our automated system can select the best defense within seconds and quickly reduce the traffic to the server within a manageable range while keeping collateral damage lower than 2%. We can handle millions of filtering rules without noticeable operational overhead.

reference

@inproceedings{Rizvi23a,
  author = {Rizvi, {A S M} and Mirkovic, Jelena and Heidemann, John and Hardaker, Wes and Story, Robert},
  title = {Defending Root {DNS} Servers Against {DDoS} Using Layered Defenses},
  booktitle = {Proceedings of the {IEEE} International Conference on Communications Systems and Networks (COMSNETS)},
  year = {2023},
  sortdate = {2023-01-03},
  project = {ant, ddidd, paaddos},
  jsubject = {network_security},
  note = {Awarded best paper},
  pages = {to appear},
  month = jan,
  address = {Bengaluru, India},
  publisher = {IEEE},
  jlocation = {johnh: pafile},
  keywords = {ddidd, ddos, filtering, frade},
  xdoi = {tbd},
  blogurl = {https://ant.isi.edu/blog/?p=1948},
  url = {https://ant.isi.edu/%7ejohnh/PAPERS/Rizvi23a.html},
  pdfurl = {https://ant.isi.edu/%7ejohnh/PAPERS/Rizvi23a.pdf}
}