When the Dike Breaks: Dissecting DNS Defenses During DDoS

G. Moura, J. Heidemann, M. Müller, R. Schmidt, Marco Davids
{"title":"When the Dike Breaks: Dissecting DNS Defenses During DDoS","authors":"G. Moura, J. Heidemann, M. Müller, R. Schmidt, Marco Davids","doi":"10.1145/3278532.3278534","DOIUrl":null,"url":null,"abstract":"The Internet's Domain Name System (DNS) is a frequent target of Distributed Denial-of-Service (DDoS) attacks, but such attacks have had very different outcomes---some attacks have disabled major public websites, while the external effects of other attacks have been minimal. While on one hand the DNS protocol is relatively simple, the system has many moving parts, with multiple levels of caching and retries and replicated servers. This paper uses controlled experiments to examine how these mechanisms affect DNS resilience and latency, exploring both the client side's DNS user experience, and server-side traffic. We find that, for about 30% of clients, caching is not effective. However, when caches are full they allow about half of clients to ride out server outages that last less than cache lifetimes, caching and retries together allow up to half of the clients to tolerate DDoS attacks longer than cache lifetimes, with 90% query loss, and almost all clients to tolerate attacks resulting in 50% packet loss. While clients may get service during an attack, tail-latency increases for clients. For servers, retries during DDoS attacks increase normal traffic up to 8x. Our findings about caching and retries help explain why users see service outages from some real-world DDoS events, but minimal visible effects from others.","PeriodicalId":20640,"journal":{"name":"Proceedings of the Internet Measurement Conference 2018","volume":"74 1","pages":""},"PeriodicalIF":0.0000,"publicationDate":"2018-10-31","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"54","resultStr":null,"platform":"Semanticscholar","paperid":null,"PeriodicalName":"Proceedings of the Internet Measurement Conference 2018","FirstCategoryId":"1085","ListUrlMain":"https://doi.org/10.1145/3278532.3278534","RegionNum":0,"RegionCategory":null,"ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"","JCRName":"","Score":null,"Total":0}
引用次数: 54

Abstract

The Internet's Domain Name System (DNS) is a frequent target of Distributed Denial-of-Service (DDoS) attacks, but such attacks have had very different outcomes---some attacks have disabled major public websites, while the external effects of other attacks have been minimal. While on one hand the DNS protocol is relatively simple, the system has many moving parts, with multiple levels of caching and retries and replicated servers. This paper uses controlled experiments to examine how these mechanisms affect DNS resilience and latency, exploring both the client side's DNS user experience, and server-side traffic. We find that, for about 30% of clients, caching is not effective. However, when caches are full they allow about half of clients to ride out server outages that last less than cache lifetimes, caching and retries together allow up to half of the clients to tolerate DDoS attacks longer than cache lifetimes, with 90% query loss, and almost all clients to tolerate attacks resulting in 50% packet loss. While clients may get service during an attack, tail-latency increases for clients. For servers, retries during DDoS attacks increase normal traffic up to 8x. Our findings about caching and retries help explain why users see service outages from some real-world DDoS events, but minimal visible effects from others.
查看原文
分享 分享
微信好友 朋友圈 QQ好友 复制链接
本刊更多论文
当堤防破裂:剖析DDoS期间的DNS防御
互联网的域名系统(DNS)是分布式拒绝服务(DDoS)攻击的常见目标,但这种攻击的结果却截然不同——一些攻击使主要的公共网站瘫痪,而其他攻击的外部影响则微乎其微。一方面,DNS协议相对简单,但该系统有许多可移动的部分,具有多级缓存、重试和复制服务器。本文使用受控实验来研究这些机制如何影响DNS弹性和延迟,探索客户端DNS用户体验和服务器端流量。我们发现,对于大约30%的客户机,缓存是无效的。然而,当缓存满时,它们允许大约一半的客户端度过持续时间少于缓存生命周期的服务器中断,缓存和重试一起允许多达一半的客户端容忍超过缓存生命周期的DDoS攻击,有90%的查询丢失,几乎所有的客户端都容忍导致50%数据包丢失的攻击。虽然客户机可能在攻击期间获得服务,但客户机的尾部延迟会增加。对于服务器来说,DDoS攻击时的重试次数会使正常流量增加8倍。我们关于缓存和重试的发现有助于解释为什么用户会在一些真实的DDoS事件中看到服务中断,而在其他事件中却看不到明显的影响。
本文章由计算机程序翻译,如有差异,请以英文原文为准。
求助全文
约1分钟内获得全文 去求助
来源期刊
自引率
0.00%
发文量
0
期刊最新文献
Reducing Permission Requests in Mobile Apps A Look at the ECS Behavior of DNS Resolvers RPKI is Coming of Age: A Longitudinal Study of RPKI Deployment and Invalid Route Origins Scanning the Scanners: Sensing the Internet from a Massively Distributed Network Telescope Learning Regexes to Extract Router Names from Hostnames
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
已复制链接
已复制链接
快去分享给好友吧!
我知道了
×
扫码分享
扫码分享
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1