信息网络安全 ›› 2019, Vol. 19 ›› Issue (9): 56-60.doi: 10.3969/j.issn.1671-1122.2019.09.012

• • 上一篇    下一篇

基于DNS应答价值评估的DDoS防御研究

岳巧丽, 吕万波, 胡卫宏, 张海阔   

  1. 中国互联网络信息中心,北京 100190
  • 收稿日期:2019-07-15 出版日期:2019-09-10 发布日期:2020-05-11
  • 作者简介:

    作者简介:岳巧丽(1985—),女,河北,硕士,主要研究方向为域名系统;吕万波(1986—),男,黑龙江,工程师,主要研究方向为域名系统;胡卫宏(1979—),男,陕西,博士,主要研究方向为网络通信协议与网络信息安全;张海阔(1981—),男,河北,博士,主要研究方向为域名系统、分布式计算、并行计算。

  • 基金资助:
    国家自然科学基金[61303242]

Mitigating DDoS Attack Based on DNS Response Value Assessment

Qiaoli YUE, Wanbo LV, Weihong HU, Haikuo ZHANG   

  1. China Internet Network Information Center, Beijing 100190, China
  • Received:2019-07-15 Online:2019-09-10 Published:2020-05-11

摘要:

针对DDoS攻击的防御策略主要是基于流量特征分析对攻击进行识别,在攻击流量到达目标主机之前进行过滤。然而这种防御策略忽略了攻击流量对于域名服务出口网络的影响。文章提出一种基于层次分析法的DNS应答价值评估方法,通过丢弃攻击流量以及优先处理高价值应答来进行防御,从而提高DNS服务质量。

关键词: DNS应答价值, 放大攻击, DDoS防御

Abstract:

The prevalent defense mechanisms against DDoS focus on detecting and filtering the attack traffic before it can reach the target host based on the traffic patterns. However, this strategy overlooks the impact of attack traffic on the outbound bandwidth of name servers. In this paper, we proposed a method for assessing DNS response value based on analytic hierarchy process. The authoritative servers can be protected by discarding low-value traffic and prioritizing to serve high-value responses, thereby improving the quality of DNS service.

Key words: DNS response value, amplification attack, DDoS defense

中图分类号: