Preventing DNS misuse for Reflection/Amplification attacks with minimal computational overhead on the Internet

Abstract

DNS reflection/amplification attacks are types of Distributed Denial of Service (DDoS) attacks that take advantage of vulnerabilities in the Domain Name System (DNS) and use it as an attacking tool. This type of attack can quickly deplete the resources (i.e. computational and bandwidth) of the targeted system. Many defense mechanisms are proposed to mitigate the impact of this type of attack. However, these defense mechanisms are centralized-based and cannot deal with a distributed-based attack. Also, these defense mechanisms have a single point of deployment which leads to a lack of computational resources to handle an attack with a large magnitude. In this work, we presented a new distributed-based defense mechanism (DDM) to counter reflection/ amplification attacks. While operating, we calculated the CPU counters of the machines that we deployed our defense mechanism with which showed 19.9% computational improvement. On top of that, our defense mechanism showed that it can protect the attack path from exhaustion during reflection/amplification attacks without putting any significant traffic load on the network by eliminating every spoofed request from getting responses.

Multi-layered firewall to mitigate the impact of Distributed Denial of Service on a network

“…It works based on a session table to keep stores the state of connections. These firewalls can work to best avoid Denial of Service (DoS) attacks by working with the session tables inside them [4][10].…”

“…Several techniques to avoid or mitigate spoofing-based attacks, such as firewalls and Virtual Private Networks (VPN), protect computational resources from getting damaged, especially during high-volume flooding attacks [2]. A firewall is a hardware, software, or hybrid-based security mechanism that monitors and controls the flow of traffic between a trusted network and outside of it [3] [4].…”

“…Therefore, designing a new type of firewall that can protect networks from spoofed traffic is essential. The most suitable solution is developing a new technique to take advantage of the Internet, Transport, and Application layer is vital to prevent the attackers from mimicking the network traffic, thus attacking their targeted system [4] [5].…”

“…They attacked the system with DDoS attacks, SQL injection, and phishing attacks on the company network and the smart house. The results of their experience showed the significance of using a Next Generation firewall in providing better protection performance for the smart house and the company network from different threats from the Internet In[4], the authors presented a distributed-based firewall to counter reflection/amplification attacks, a form of Distributed Denial of Service (DDoS) attacks. Their method showed a 19.9% improvement in CPU load during attacks.…”