A Software-based Approach to Generate and Detect Flooding Attacks against DNS Infrastructure - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2017

A Software-based Approach to Generate and Detect Flooding Attacks against DNS Infrastructure

Résumé

In this presentation we show our ongoing work to develop a testbed --based on software and commodity hardware-- to research on flooding attacks against DNS infrastructure. We have currently developed two prototype components: a flooding DNS query generator, able to saturate 10GbE links with 11Mrps, and an online detector of overabundant queried domains at reception. Relying on DPDK and libmoon (a LuaJIT framework for DPDK), these two tools run on commodity hardware, while optimizing the number of packets that we can handle at transmission and reception. Both generation and reception tools run Lua scripts, achieving a high level of flexibility. In this presentation we show some lessons we are learning, we compare the generator against other available tools, and present some unexpected results. For example, how a slower software query generator has a stronger impact on a Bind server than our current flooding tool (650Krps versus 10Mrps). We also describe how we count the number of queries per domain at reception under 11Mrps traffic, with reduced packet losses. Given the high number of possible elements to analyse from the DNS messages (IP addresses, random qnames) we make use of statistical tools, mainly CountMin-Sketch, to restrict the use of memory space. This tool can trigger an alarm when a domain exceeds a threshold of queries per a small interval of time. In this presentation we also look for feedback from the DNS-OARC community about possible strategies to use this tool to countermeasure flooding attacks.
Fichier non déposé

Dates et versions

hal-01581496 , version 1 (04-09-2017)

Identifiants

  • HAL Id : hal-01581496 , version 1

Citer

Santiago Ruano Rincon, Sandrine Vaton, Stéphane Bortzmeyer. A Software-based Approach to Generate and Detect Flooding Attacks against DNS Infrastructure. OARC 26 2016 : workshop DSN-OARC - Domain Name System Operations Analysis ane Research Center, May 2017, Madrid, Spain. ⟨hal-01581496⟩
197 Consultations
0 Téléchargements

Partager

Gmail Facebook X LinkedIn More