Method and system for defending pulse DDoS attack based on anonymous DNS protocol

Abstract

The invention discloses a defense method and system for pulse DDoS attacks based on an anonymous DNS protocol, and relates to the technical field of DNS security. According to the method, the problems that the available delay range is relatively small, the address of an attacker is easy to track and the like in the existing pulse DDoS attack based on the DNS recursive resolver are effectively solved. According to the method, the confidentiality of the anonymous DNS is utilized, communication content is encrypted, and identity information such as an IP address of an attacker is hidden at the same time, so that the ISP and the recursive server almost cannot track the identity of the client. A large number of communication paths with different delay characteristics are generated by performing Cartesian product pairing on relays and servers in an anonymous DNS protocol. According to the invention, discrete event simulation is carried out on an experimental environment by using ns.py, and an experiment is carried out on a local Windows 11 machine. The influence of reducing the relay cascade length and reducing the request timeout time of the client on the attack effect is explored, the difference between request distribution and peak amplification times under the condition of different cascade layer numbers and request timeout time is simulated, and the effectiveness of the mitigation method is verified. Through verification, the method effectively reduces the influence of the pulse DDoS attack based on the anonymous DNS protocol.

Description

Technical Field

[0001] This invention relates to the field of DNS security technology, specifically to a defense method and system for pulse DDoS attacks based on anonymous DNS protocol. Background Technology

[0002] The Anonymous DNS protocol was originally proposed to protect user privacy, aiming to hide the identity of the requester and prevent eavesdropping by man-in-the-middle attacks and servers. However, when attackers use the Anonymous DNS protocol and its infrastructure to conceal their identities and launch DDoS attacks, traditional detection methods struggle to effectively trace the attacker's true identity. Furthermore, the multi-layered nature of the Anonymous DNS infrastructure and the flexibility of request paths provide attackers with a larger attack window, becoming a breeding ground for pulse DDoS attacks. Therefore, while providing privacy protection, the Anonymous DNS protocol also introduces greater security threats.

[0003] The principle of anonymous DNS protocol:

[0004] In traditional DNS protocols, requests and responses are transmitted in plaintext, meaning that any intermediary operator can view sensitive information throughout the request process. Specifically, recursive resolvers can clearly identify which user requested which domain name. DNS servers provided by Internet Service Providers (ISPs) typically act as recursive resolvers, but in the process, they collect vast amounts of personal information, which they then sell to advertisers for profit. Furthermore, DNS remains the most common, cheapest, and simplest method for monitoring and blocking traffic. [1] This is also the simplest way to hijack traffic. Therefore, the plaintext transmission of domain name requests also provides opportunities for government regulation. Once a user requests a website that may be involved in malicious activity, regulatory agencies can potentially cut off access to that website and strengthen monitoring and control of internet content. This situation poses a potential threat to user privacy and freedom of information.

[0005] To address the issue of user privacy leaks under the traditional DNS protocol, various encryption protocols for DNS have been proposed, collectively known as DNS-over-Encryption (DoE). [2] , such as: DNS-over-TLS(DoT), DNS-over-DTLS [3] , DNS-over-HTTPS(DoH), DNS-over-QUIC(DoQ) [4]Their common goal is to encrypt DNS requests using public-key cryptography to prevent user privacy from being violated by Internet Service Providers (ISPs). However, this encryption method only guarantees that communication will not be eavesdropped on, not that the client will remain anonymous to the DNS server. The DNS server can still maliciously obtain the client's IP address and query information to construct a DNS graph, linking the client's identity information with the queried domain name, thereby causing privacy leaks or sending fraudulent emails, targeted advertising, etc.

[0006] To address privacy issues that standards like DOT cannot resolve, ODNS was developed. ODNS stands for Oblivious DNS, where Oblivious means "undetectable," referring to a DNS protocol that cannot be detected by man-in-the-middle or eavesdroppers during transmission. It was proposed in 2018 by Paul Schmitt, Anne Edumundson, and others from Princeton University and is expected to become one of the IETF standards.

[0007] like Figure 1 As shown, the core concept of anonymous DNS is to introduce a new server—the Anonymous DNS Server (ODNS Server)—between the recursive resolver and the authoritative server. This ODNS Server is responsible for performing recursive domain name resolution. From the perspective of the recursive resolver, it appears as a regular authoritative server; any domain name request ending in .odns is forwarded to this ODNS Server. In this case, the original recursive resolver acts as a proxy. The anonymous DNS protocol separates the IP address from the query, ensuring not only that the recursive resolver cannot know the request content, but also that the ODNS Server only knows the request content, not who initiated the request (the requester's IP address). In other words, the various server nodes processing the DNS request cannot associate the requester with the request content, thus effectively protecting user privacy.

[0008] This innovative design enables ODNS to provide a higher level of privacy protection when processing domain name resolution, avoiding the information leakage problems that may exist in traditional DNS protocols. Due to its potential privacy-enhancing features, ODNS is expected to become a more widely adopted DNS privacy protection solution in the future, providing users with a more secure online environment.

[0009] Traditional burst DDoS attacks based on DNS recursive resolvers have the following drawbacks:

[0010] (1) Limited available latency range: Since recursive parsers typically contain only a single-layer structure, the available latency range is very small, and attackers can only achieve traffic aggregation within an extremely limited time window. This limitation results in poor pulse amplification and makes it difficult to generate high-traffic pulse attacks.

[0011] (2) Attacker addresses are easy to trace: Since the DNS requests issued by the attacker are in plaintext, ISPs can easily detect a large number of suspicious DNS requests and take blocking measures. In addition, the recursive server, as an intermediary, can directly obtain information such as the attacker's IP address and the requested domain name, thereby tracing the source of the attack and identifying the attacker's identity.

[0012] Currently, research on pulse DDoS attacks targeting anonymous DNS protocols is lacking, and there is no fundamentally effective solution. Summary of the Invention

[0013] The technical problem to be solved by this invention is that existing pulse DDoS attacks based on DNS recursive resolvers have problems such as a small exploitable latency range and easy tracking of attacker addresses. Therefore, this invention provides a defense method and system for pulse DDoS attacks based on anonymous DNS protocol.

[0014] The technical solution adopted by the present invention to solve the above-mentioned technical problems is as follows:

[0015] A method for defending against pulse DDoS attacks based on anonymous DNS protocol, the method comprising:

[0016] 1) Construct a threat model for anonymous DNS time-lensing pulse DDoS attacks. Assume that the attacker has the ability to spoof identities, schedule requests, and control domain facilities. The attacker creates their own domain on an authoritative server provider and adds relevant records to launch the attack, or adds large TXT records to consume server traffic.

[0017] 2) Multi-layer time lensing based on relay servers expands the attack window, thereby focusing more attack traffic.

[0018] A relay-server time lensing technique is proposed, which increases the number of intermediate server layers to multiple layers, thereby expanding the latency range and improving the effectiveness of pulse attacks.

[0019] The relay-server lens replaces the CDN server with an intermediate proxy relay and anonymous DNS server, changing from a single-layer lens to a double-layer lens. The request message type is either TCP or UDP in the anonymous DNS protocol. The relay and anonymous DNS servers can construct different paths, focusing the traffic generated by multiple paths to arrive at the same time.

[0020] 3) Relay cascading based on anonymous DNS protocol increases latency range and expands the attack window.

[0021] A relay cascading based on the anonymous DNS protocol is proposed. By utilizing the characteristics of the μODNS protocol, different numbers of relays are cascaded to increase path latency, expand the latency range, and ultimately improve the amplification effect.

[0022] This protocol enhances privacy by cascading intermediate proxy servers, allowing attackers to conceal their identities. It can also expand the attack window by cascading multiple relays, turning a single relay layer into multiple layers, resulting in longer paths and larger attack windows. Furthermore, it can be used to create more diverse paths, allowing more attack traffic to be stored in the transmission path and generating higher-intensity pulses.

[0023] 4) Request queuing based on client timeout

[0024] By leveraging the client request timeout period of the anonymous DNS protocol, request latency can be precisely controlled, thereby gaining a larger attack window;

[0025] Request queuing is divided into a preparation phase and a pulse phase. In the preparation phase, assuming the length of the request message is n bytes, the attacker first sends n-1 bytes of the request to the relay. Since the relay has a client request timeout period, it will save the first n-1 bytes of the request in memory and wait for the client to send the last byte. Once the relay receives the last byte, it will immediately forward the request to the anonymous DNS server. The client can arbitrarily specify how long to send the last byte. The client uses the last byte to "command" when the relay sends the entire request message.

[0026] Detect the timeout period of open anonymous DNS relays across the entire network;

[0027] To avoid errors in probe results caused by communication failures between relays and servers, the connectivity between relays and servers is first checked. Each relay corresponds to a set of connected servers, and during the probe, a server is selected from this set and paired with it.

[0028] Based on the maximum client request timeout detected for each relay, a mapping is constructed from the relay to its maximum client timeout, which is used as the maximum request delay time in the request queue.

[0029] 5) Flatten the request sequence.

[0030] Attackers need to select available SR pairs at each time point to send request messages and ensure that the load distribution of each SR pair path is even, flattening the request sequence to maximize bandwidth utilization.

[0031] The present invention has the following beneficial technical effects:

[0032] The defense method against pulsed DDoS attacks based on anonymous DNS protocol provided by this invention effectively solves the aforementioned technical problems. The multi-layer time lensing based on anonymous DNS designed in this invention enhances the attacker's anonymity and increases the traffic amplification factor. This invention utilizes the concealment of anonymous DNS by encrypting communication content and hiding the attacker's IP address and other identity information, making it almost impossible for ISPs and recursive servers to trace the client's identity, thereby significantly improving the attacker's anonymity and achieving attacker identity anonymity. This invention employs a multi-layer time lensing technique, generating a large number of communication paths with different latency characteristics by pairing relays and servers in the anonymous DNS protocol using Cartesian products. These paths collectively constitute a multi-layer time lens, which can significantly expand the attack window, achieve a higher traffic amplification factor, and enhance the attack effect.

[0033] This invention proposes a multi-layer time-lensing pulse DDoS attack and its defense techniques against the anonymous DNS protocol, including reducing relay cascading length and client request timeout time. Discrete event simulations were performed in the experimental environment using ns.py, and experiments were conducted on a local Windows 11 machine. The impact of reducing relay cascading length and client request timeout time on the attack effect was investigated. The differences in request distribution and peak amplification factor under different cascading layers and request timeout times were simulated, verifying the effectiveness of the mitigation method. The invention effectively reduces the impact of pulse DDoS attacks based on the anonymous DNS protocol.

[0034] Because anonymous DNS hides the attacker's identity, traditional tracing methods become ineffective. The following methods can mitigate the impact of DDoS attacks to some extent: First, reduce relay cascading length: Since a longer relay cascading length provides a larger attack window for the attacker, a maximum cascading length can be set for μODNS to reduce the request latency window. Second, reduce client request timeout: Minimize the timeout time of relay and anonymous DNS servers, or set a recommended value to prevent attackers from exploiting request queuing.

[0035] Currently, the research community lacks an effective defense method against pulsed DDoS attacks using the anonymous DNS protocol. The defense method proposed in this invention can effectively reduce the effectiveness of this type of attack. Attached Figure Description

[0036] Figure 1 This is a block diagram of the anonymous DNS protocol. Figure 2 This is a block diagram of the DNSCrypt protocol. Figure 3 This is a block diagram of the ODoH protocol. Figure 4A schematic diagram illustrating possible collusion scenarios in ODNS relay. Figure 5 This is a diagram illustrating the principle of a pulse attack. Figure 6 This is a schematic diagram of a CDN time lens. Figure 7 This is a schematic diagram of a relay-server lens. Figure 8 This is a diagram illustrating the principle of a relay-server time-lensing DDoS attack. Figure 9 This is a schematic diagram of a relay cascade. Figure 10 This is a diagram of a relay cascade attack. Figure 11 To request a queuing diagram, Figure 12 This is a diagram illustrating the maximum client request timeout for relays. Figure 13 This is a schematic diagram of the feasible region for one-way path delay STT; Figure 14 The images show the effects before and after the flattening request. In the images: (a) is before the flattening request, and (b) is after the flattening request. Figure 15 This is a diagram of the simulation environment structure. Figure 16 This diagram illustrates the impact of relay cascading levels on amplification. Figure 17 The effect of request timeout on magnification. Detailed Implementation

[0037] Combined with appendix Figure 1-17 The implementation of the defense method against pulse DDoS attacks based on anonymous DNS protocol described in this invention is explained as follows:

[0038] I. Implementation of Anonymous DNS Protocol:

[0039] The previous section introduced the principles of the anonymous DNS protocol. Based on the concept of the anonymous DNS protocol, the research community has implemented various types of anonymous DNS implementations and extensions, including the DNSCrypt protocol, the ODoH protocol, and MutualizedODNS. [5] The protocol, etc., will provide a detailed introduction to these common anonymous DNS protocols.

[0040] DNSCrypt Protocol: With the development and application of anonymous DNS protocols, many open DNS servers support anonymous DNS protocols, and many new anonymous DNS servers have been put into use, making the entire anonymous DNS network architecture a request forwarding platform that attackers can exploit. This invention utilizes the DNSCrypt protocol, a protocol that encrypts, authenticates, and optionally anonymizes communication between DNS clients and DNS resolvers. It can prevent DNS spoofing. It uses cryptographic signatures to verify that the response comes from the selected DNS resolver and has not been tampered with.

[0041] DNSCrypt [6]The protocol differs from the traditional ODNS protocol in that it places the ODNS server between the relay and the recursive resolver (e.g., Figure 2 This method encrypts the entire DNS request message, rather than just the requested domain name. While this exposes the requester's message content, it is subject to ISP oversight on the recursive side. However, because the recursive resolver cannot know the requester's IP address, its privacy is still guaranteed.

[0042] DNSCrypt not only implements its own anonymous DNS protocol, DNSCrypt, but also the ODoH protocol. The difference between them is that the former actually uses the anonymous DNS protocol for encryption between the client and the target server, thus supporting encryption of ordinary UDP DNS messages, while the ODoH protocol uses DoH to implement TLS encryption between the client and the target server, and both requests and responses are based on HTTP messages.

[0043] The DNSCrypt client allows users to choose their own relay and anonymous DNS servers. Currently, the official website lists as many as 709 anonymous DNS servers, including 432 open DNSCrypt servers, 197 DNSCrypt relays, 4 ODoH relays, and 12 ODoH servers. Popular DNS software such as BIND, Unbound, and PowerDNS all support the DNSCrypt protocol.

[0044] Oblivious DoH (ODoH) Protocol: DoH is a protocol that uses HTTP and public-key cryptography to transmit DNS messages. It ensures transmission security without relying on DNSSEC. Related studies have shown that using DoH does not significantly increase page load time. [7] Therefore, this technology has been widely used. Anonymous DoH (ODoH) is a new encrypted communication protocol proposed in response to the DoH protocol. It consists of a client, a relay, and an ODoH server, where the ODoH server is also called the target. ODoH borrows the principles of ODNS, using public-key encryption and relay proxy servers to ensure that only querying users can simultaneously access DNS messages and their IP addresses (such as...). Figure 3 ).

[0045] Specifically, an encrypted transmission link is established between the client and the target resolver using an asymmetric key. The client first encrypts the request content using the server's public key, then forwards the encrypted request along with its public key to the proxy server. The proxy server then forwards it to the target server, which decrypts it using its private key and encrypts it again using the client's public key before returning the response. During this process, ODoH ensures that: 1) the target can only see the query and proxy IP addresses; 2) the proxy cannot see DNS messages and cannot identify, view, or modify the client's query or the answer returned by the target (ODoH server); 3) only the intended target can read the query content and generate a response.

[0046] Mutualized Oblivious DNS (μODNS) protocol: Although anonymous DNS protects the client's IP address through an intermediate relay, its security relies on the assumption that the relay and the server will not collude. However, if the relay and the server collude, the client's privacy may still be compromised. Figure 4 As shown: 1) Public relays may be colluding with the target Resolver X; 2) Shared relays may be established by other clients and are spies for X; 3) Users using a single dedicated relay can cause X to be able to match user and relay IP addresses one-to-one.

[0047] Mutualized Oblivious DNS (MODNS) is an extension of the existing anonymous DNS protocol DNSCrypt. It improves the protocol for privacy by addressing the issue of relays potentially colluding with the target server. Using query promiscuity technology (Table 1), it allows multiple relays to cascade and forward packets to the destination. In this way, all hops except the first one do not know the source address of the message, thus preventing collusion.

[0048] μODNS overcomes the drawback of collusion between servers and relays in a single relay configuration. Borrowing from the Tor network, it cascades multiple relays and allows users to choose a trusted relay as their first hop. This ensures that each relay is unaware of the source of the forwarded request. Key features of μODNS include: 1) Users choose a trusted dedicated relay as their next hop; 2) Users share their dedicated relays with other users to achieve query mixing (each relay is unaware whether the message originated from a user or another relay); 3) Random selection of subsequent relay sequences prevents attackers from targeting nodes within a fixed sequence.

[0049] Table 1 explains a series of terms for μODNS.

[0050]

[0051] II. Pulse DDoS Attack

[0052] (I) DDoS Attack Principles: A DDoS (Distributed Denial of Service) attack is a type of attack that sends a large amount of useless traffic to a target server or network through a large number of computers or network devices. The aim is to exhaust the target system's resources, causing service unavailability and ultimately preventing legitimate users from accessing the service. A key characteristic of DDoS attacks is the use of multiple distributed attack sources, increasing the scale and complexity of the attack and making it difficult to effectively defend against with simple defenses. Attackers typically utilize multiple maliciously controlled computers, IoT devices, servers, etc., to form a "botnet." [8] The infected node (called a bot) then launches an attack through this network. Each infected node sends requests to the target system, utilizing its resources (such as bandwidth, CPU, and memory) to deplete its service capacity, causing the target system to crash or become unable to handle legitimate requests. Common types of DDoS attacks include:

[0053] 1. Volume-Based Attacks: These attacks primarily involve flooding the target with a large amount of network traffic, overwhelming the target system and causing service interruption. Common attack methods include:

[0054] (1) UDP Flood [9] This tactic involves sending a large number of unresponsive UDP packets to the target, thus consuming the target's bandwidth and resources.

[0055] (2) ICMP Flood

[10] : Exhaust the target's bandwidth by sending a large number of ICMP echo requests (ping).

[0056] (3) DNS Flood

[11] This involves consuming DNS server resources through a large number of forged DNS requests.

[0057] 2. Protocol Attacks: These attacks exploit vulnerabilities in protocols to exhaust the target system's connection resources (such as TCP connection pools) or the processing power of network devices. Common attack methods include:

[0058] (1) SYN Flood

[12] Attackers send a large number of half-open connection requests (SYN requests), consuming the target server's connection queue and preventing the target from processing normal requests.

[0059] (2) Ping of Death

[13] Attackers send excessively large ICMP packets, exceeding the target device's processing capacity, causing the target to crash or restart.

[0060] (3) Smurf Attack

[14] Using IP broadcast requests, ICMP requests are sent to all hosts on the network, thereby saturating the network bandwidth.

[0061] 3. Application Layer Attacks: These attacks specifically target vulnerabilities at the application layer, simulating normal user requests to consume the target server's computing and memory resources. Common attack methods include:

[0062] (1) HTTP Flood

[15] Attackers send a large number of seemingly normal HTTP requests (e.g., page load requests, image requests) to exhaust the web server's processing power.

[0063] (2) Slowloris

[16] By slowly establishing HTTP connections (e.g., sending incomplete HTTP requests), the target server is kept in a connected state, eventually exhausting its connection pool and making the server unable to handle connections from legitimate users.

[0064] DNS reflection amplification attack

[0065] Among DDoS attacks targeting DNS authoritative servers, the most common is reflection amplification attack. The advantage of reflection amplification attack is that it allows attackers to hide their IP address, and victims can only see packets sent from the recursive server without knowing the true source.

[17] This paper proposes a pulse attack that uses an open DNS recursive resolver as a lens. A CNAME chain attack is employed on the authoritative server side to create a continuous pulse, achieving a 14x amplification effect. However, this method can only utilize open DNS servers, resulting in a limited scalable attack window and a relatively small amplification factor, thus limiting its effectiveness against attackers. Furthermore, since the attack traffic remains plaintext DNS and the source IP address is easily traced, it is easily identified and filtered by ISPs.

[0066] (ii) Principle of pulsed DDoS attacks: Currently, there is extensive research on DDoS attacks targeting DNS infrastructure, such as the NXDOMAIN attack.

[18] NXNS attacks and the improved NRDelegation attack targeting them.

[19] CNAME chain attacks, among others, can significantly deplete the target server's CPU and bandwidth resources. However, traditional DNS flood attacks are limited by the attacker's bandwidth and require a botnet, which incurs substantial costs. Therefore, Luo...

[20] A novel DoS attack method, called a Pulsing Attack, is proposed. Pulsing DoS attacks are a form of low-rate DoS attacks. Compared to traditional Flooding Attacks, Pulsing Attacks generate high-bandwidth pulses with relatively small traffic volumes, making them more difficult to detect and defend against, and consuming fewer resources. In a Pulsing Attack, traffic consists of many brief but high-bandwidth spikes or pulses. For TCP services, pulses cause packet loss in TCP connections, forcing them to adjust their congestion windows and reduce throughput; for UDP services, pulses cause a sudden increase in server resource consumption, increase packet loss rates, and cause service instability. Figure 5 As shown, the attacker controls a large number of botnets, uses these botnets to construct paths with different latency, and sends requests in order from high latency path to low latency path, thereby ensuring that the requests arrive at the target server at the same time.

[0067] (iii) Time Lens Based on CDN: In the HTTPS domain, pulsed DDoS attacks also exist, such as those using CDN servers to aggregate traffic. Current CDN operations are too lenient in their client-controlled forwarding policies and lack origin verification.

[21] Furthermore, due to the sheer number of CDN edge servers, resembling a large-scale proxy server cluster, malicious CDN customers can configure these edge servers to redirect traffic to arbitrary domains or IP addresses, even if the resources do not belong to them.

[22] Exploiting the inadequacy of CDN nodes in verifying source addresses, researchers proposed a pulse attack that uses global CDN servers as lenses. For example... Figure 6 As shown, attackers register a legitimate CDN account and customize its Origin address to redirect traffic from millions of CDN servers worldwide to the target server. More seriously, because these traffic paths are typically located in the network backbone, the attack significantly impacts the stability of the entire network. Furthermore, the authors innovatively propose several methods to expand the attack window, including utilizing CDN cascading, DNS pauses, and IP fragmentation-based request queuing mechanisms, further increasing the threat of the attack.

[0068] However, this type of attack also has some drawbacks: 1) Attackers cannot simply use other websites' CDN servers, but need to purchase a large number of controlled CDN servers to participate in amplification, which introduces a lot of costs to attackers; 2) Most DNS servers only support the UDP protocol, while CDN servers only support the HTTP protocol, which cannot send legitimate DNS requests, and therefore cannot use related technologies for DNS response amplification.

[0069] It is possible to use CDN lenses in conjunction with DoH or ODoH protocols to convert HTTP traffic into DNS traffic and launch DDoS attacks, but this method is not within the scope of this invention.

[0070] IV) Time Lens Based on IP Fragmentation

[0071] While the DNS protocol provides a sufficient timeout period (approximately 10 seconds), IP fragmentation technology can further extend this timeout range. IP fragmentation is used to divide large IP packets into multiple smaller packets for network transmission. Each IP packet carries an IPID and MF flag to indicate whether there are more fragments. Received fragments are stored in the kernel's fragmentation reassembly cache.

[23] This allows attackers to exploit the fragmentation reassembly timeout to queue requests. For example, the default fragmentation reassembly timeout for Linux IPv4 is 30 seconds, while it is 60 seconds for IPv6.

[24] Linux's reassembly buffer can hold a maximum of 64 fragments for IPv4, while there is no limit to the number of fragments for IPv6.

[0072] Therefore, an attacker can split the query packet into two fragments: fragment 1 contains the majority of the packet content, and fragment 2 contains the remaining 8 bytes of payload (because the fragment data payload must be at least 8 bytes long).

[25] All Fragment 1 packets are sent to the resolver during the fragment reassembly timeout, while Fragment 2 packets are delivered within the DNS timeout period before the fragmentation timeout. When a DNS query reassembles, the resolver queries the authoritative server. The authoritative server returns a response until nearing the timeout, thus ensuring a large cumulative time window (30 or 60 seconds).

[0073] However, IP fragmentation technology has long been considered to have security issues (RFC 5722).

[26] Many firewalls typically block fragmented IP packets, and some do not implement the algorithms required to reassemble fragmented packets.

[27]

[28] This caused the message to fail to reach its destination.

[29] IP fragmentation has long been used in DNS cache poisoning attacks, which can then be further exploited to disrupt DNSSEC's CA trust chain.

[30] Due to these issues, the IP and DNS communities have reached a consensus that IP fragmentation should be avoided in DNS.

[31] Secondly, while IPv6 prohibits routers from performing IP fragmentation, anonymous DNS relay also supports IPv6. Using only IPv4 might render some paths unusable. Furthermore, the TCP protocol does not favor IP fragmentation, and most major implementations discover IPs by using path MTU.

[32] To avoid TCP segment fragmentation, IP fragmentation has limited effectiveness in anonymous DNS protocol transmission based on TCP.

[0074] Based on the above, the attack method proposed in this invention is as follows:

[0075] Building a threat model

[0076] This paper introduces a threat model for anonymous DNS time-lensing pulse DDoS attacks, assuming the attacker possesses the following capabilities:

[0077] (1) Identity spoofing capability: Attackers can impersonate legitimate users and use the anonymous DNS protocol to send low-rate legitimate traffic to different relays. For lens pulse attacks using anonymous DNS relays, attackers only need to launch the attack from a single probe point, which can be any low-rate device, without relying on a botnet with bandwidth greater than or equal to that of the victim. The victim server can only see the IP address of the anonymous DNS server and does not know the IP address of the client, so it cannot filter by client IP.

[0078] (2) Request scheduling capability: Attackers can pre-measure the round-trip latency of each relay and server relative to themselves, construct a server latency table, and carefully design the order and time interval of request sending, so that the attack traffic can accurately reach the target host at the same time. Malicious attackers can even design different relay-server paths, or cascade multiple relays to form traffic with diverse latency characteristics, significantly expanding the attack window.

[0079] (3) Domain Name Control Capability: Attackers control the domain name provided by the target authoritative server and can add specific records through the domain name to launch attacks, such as NXDOMAIN, NXNS, CNAME CHAIN, etc. In addition, they can use large TXT records to consume server bandwidth and further enhance the attack effect.

[0080] Attackers can create their own domains with authoritative server providers and add related records to launch attacks such as NXDOMAIN, NXNS, and CNAME CHAIN, or add large TXT records to consume server bandwidth.

[0081] Multi-layer time lens based on relay-server

[0082] Traditional reflection amplification attacks using recursive resolvers only have one layer of time lensing, namely the recursive resolver. This limits latency expansion capabilities. To further expand the attack window and focus more attack traffic, this invention proposes a two-layer time lensing technology based on the anonymous DNS protocol: relay-server time lensing. This increases the number of intermediate server layers to two, further expanding the latency range and improving the effectiveness of pulse attacks.

[0083] Typical DDoS attacks manifest as continuous, high-intensity malicious traffic, a characteristic that is easily identified and mitigated by detection teams.

[33] With the development of the internet, a series of different DDoS attacks have been discovered. Among these strategies, pulsed DDoS attacks are a special type of distributed denial-of-service (DDoS) attack, characterized by attacks delivered in short bursts or bursts, occurring in a clockwise, ordered manner. Compared to traditional continuous flood attacks, pulsed DDoS attacks use an intermittent approach to generate high-intensity traffic surges on the target machine. The attack compresses the original transmission into a sharp pulse of traffic, which can completely fill the victim's buffer, causing packet loss and congestion, ultimately leading to a decline in the target server's service quality. It can efficiently utilize the attacker's bandwidth resources and increases the unpredictability and detection difficulty of the attack.

[0084] Anonymous DNS ensures confidentiality by employing an encrypted DNS transport protocol and placing a proxy server (relay) between the client and server. Since the transmitted content is encrypted using the client and server's private keys, only the client and the anonymous DNS server can decrypt the communication. However, because the proxy server blindly forwards received packets without inspection, it can be used by attackers as a magnifying glass for DNS pulse attacks, while simultaneously concealing the attacker behind the proxy layer.

[0085] like Figure 7 As shown, the relay-server lens is similar to a lens utilizing a CDN server, but instead of a CDN server, it uses intermediate proxy relays and anonymous DNS servers, transforming it from a single-layer lens to a double-layer lens. Furthermore, the request message type is changed from the original HTTP message to TCP or UDP messages in the anonymous DNS protocol. Relay and anonymous DNS servers are distributed globally, allowing the construction of different paths. Because the latency of paths composed of different relays and servers varies, this provides attackers with a large latency window. This latency window acts like a lens, focusing traffic from multiple paths onto the target network, causing it to arrive at the same time. Figure 8As shown, the basic process of an anonymous DNS time-lensing pulse DDoS attack is as follows:

[0086] Step 1: The attacker randomly pairs anonymous DNS relays with the target server, generating different paths in the form of "number of relays × number of servers".

[0087] Step 2: The attacker performs latency measurements on the generated paths to obtain the round-trip time (RTT) for each path.

[0088] Step 3: Calculate the one-way delay of each path using one-way delay fitting technology, and select the path with smaller variance as the candidate path to ensure delay stability.

[0089] Step 4: Combining traffic amplification and attack window expansion techniques, attackers carefully design request sequences based on the one-way latency of candidate paths, so that requests sent along different paths can arrive at the target server (Target) at the same time.

[0090] Step 5: Following a pre-constructed sequence of requests, the attacker sends DNS requests at a low rate to different paths.

[0091] Step 6: Due to the focusing effect of the RS lens, traffic arrives at the target server simultaneously, forming a pulsed traffic peak, which can lead to service instability, resource exhaustion, or even server crashes.

[0092] Relay cascading technology based on anonymous DNS protocol

[0093] Traditional DDoS attacks targeting DNS infrastructure cannot extend path length, thus limiting the attack window and the ability to aggregate traffic over a longer period, resulting in limited packet amplification. To further increase latency and expand the attack window, this invention proposes a relay cascading technique based on the anonymous DNS protocol. The core idea is to leverage the characteristics of the μODNS protocol to cascade different numbers of relays (e.g., ...). Figure 9 This increases the path delay, expands the delay range, and ultimately improves the amplification effect.

[0094] Jun Kurihara et al. proposed a method to cascade multiple relays to achieve anti-collusion effects, called Mutualized Oblivous DNS (μODNS), which is similar to the Tor network or the Tor network.

[34] This technology addresses the issue of relays potentially colluding with the target server by improving the protocol's privacy features, allowing multiple relays to be chained together to forward data packets to the destination. Figure 10In this way, none of the hops other than the first one know the source address of the message. The client can define this relay sequence arbitrarily; the user only needs to set its trusted relay as the next-hop relay.

[0095] This protocol enhances privacy through cascading intermediate proxy servers, but it also creates better conditions for pulse attacks. Attackers can not only better conceal their identities but also expand their attack window by cascading multiple relays, turning a single relay layer into multiple layers, resulting in longer paths and a larger attack window. Furthermore, because the μODNS protocol allows users to freely choose their relay list, it can create more diverse paths, allowing more attack traffic to be stored in the transmission path and generating higher-intensity pulses.

[0096] like Figure 10 As shown, the attack flow of a relay-cascaded anonymous DNS pulse DDoS attack is as follows:

[0097] Preparation phase: (1) The attacker modifies the configuration file of the anonymous DNS (proxy) client to construct paths with different numbers of relays, thereby maximizing the use of latency range. (2) The attacker combines relays of different cascade lengths with all servers using Cartesian products to construct a path list. (3) The attacker uses low-frequency latency probing technology to measure the latency of each group of paths and sorts them from low to high. (4) The attacker uses one-way latency fitting technology to fit the one-way request latency of each group of paths and filters out paths with variance less than a threshold to add to the filtered list.

[0098] Attack Phase: Attackers utilize request sequence scheduling algorithms and traffic amplification techniques to send requests sequentially according to a pre-constructed request sequence, ranked from highest to lowest path latency. The entire attack path includes the anonymous DNS protocol layer (such as cascading relays, anonymous DNS servers, and recursive resolvers) and the DNS protocol layer (recursive resolvers), ultimately leading to the target authoritative server. At the anonymous DNS protocol layer, attackers use encrypted TCP traffic to transmit data to prevent man-in-the-middle eavesdropping, further concealing their identity and increasing the difficulty of tracing the source. At the DNS protocol layer, the traffic is converted to plaintext UDP, indistinguishable from ordinary DNS traffic, making it difficult to differentiate from normal traffic and significantly enhancing the attack's stealth.

[0099] However, more relay cascades are not always better. Because after relay cascading, the latency fluctuation is the sum of the latency fluctuations between multiple relays, the range of latency fluctuations also increases, meaning the variance of STT (Solution Time To Time) increases. This affects the accuracy of message sequence arrival. Specifically, for any cascaded path, we have:

[0100] (1)

[0101] Where r represents a relay, and R is the set of all relays. To request queuing delay, is the average delay per hop of the relay, and jitter is the jitter per hop.

[0102] The first two terms in the formula are constants, and the third term is white noise. Therefore, although increasing the number of hops will increase the STT and expand the attack window, it will also cause the accumulation of latency jitter, leading to increased uncertainty in the final STT, and consequently, a worsening of the traffic aggregation and amplification effect.

[0103] Request queuing technology based on client timeout

[0104] Request queuing principle

[0105] Since client-to-target server request latency is typically not high, attackers have a relatively small time window to exploit, making it difficult to accumulate significant traffic. To expand the attack window, this invention proposes a request queuing technique based on anonymous DNS. Unlike most IP fragmentation-based request queuing, the core idea of ​​this technique is to precisely control request latency at the application layer using the client request timeout of the anonymous DNS protocol, thereby achieving a larger attack window. This method can be combined with IP fragmentation to achieve an even larger attack window.

[0106] Anonymous DNS request queuing utilizes the client message response timeout to block the anonymous DNS protocol relay by the last byte. For example... Figure 11 As shown, request queuing is divided into a preparation phase and a pulse phase. In the preparation phase, assuming the request message is n bytes long, the attacker first sends n-1 bytes of the request to the relay. Because the relay has a client request timeout period, it will store the first n-1 bytes of the request in memory, waiting for the client to send the last byte. Once the relay receives this last byte, it will immediately forward the request to the anonymous DNS server. The client can arbitrarily specify the interval at which to send this last byte. Therefore, the client can use this last byte to "command" when the relay sends the entire request message. The bandwidth occupied by this last byte is almost negligible, which gives the attacker a great deal of time to accumulate messages on the relay. The longer the accumulation lasts, the greater the impact of the messages sent by the relay.

[0107] The request queuing method makes it more flexible for attackers to construct request sequences. For example, for a single SR path, if its one-way request latency is stt, the maximum client request timeout for the relay is... The server receiving time is set to Assuming the number of requests constructed is n, the request interval can be set arbitrarily. The transmission time sequence is then:

[0108] (2)

[0109]

[0110] A single path can construct a sequence of n+1 requests, and in addition, the sending time window will be changed from the original... Expanded to .

[0111] Experimental testing revealed that the timeout for anonymous DNS requests is approximately 9 seconds, while the typical path latency is only around 300ms. Therefore, this method can significantly expand the attack window.

[0112] Timeout detection

[0113] To maximize the accumulation of requests along the intermediate path and extend the request sending time window, thereby enabling the simultaneous transmission of higher traffic, it is necessary to calculate the maximum timeout for client requests. For example... Figure 12 As shown, after a client's request is sent, it first arrives at the anonymous DNS relay, where it is queued. Therefore, the amplification effect of request queuing depends solely on the client request timeout time of the anonymous DNS relay. When the relay detects a client request timeout, it discards the request, thus reducing the amplification effect. To prevent this problem, it is necessary to probe the timeout times of all open anonymous DNS relays across the network.

[0114] In practice, a connected path needs to be selected for each anonymous DNS relay. After sending the first n-1 bytes of the data packet, the last byte is sent after a waiting period of varying duration. If the relay returns a correct response, the timeout period is considered valid. Experiments revealed that when the timeout reaches 10 seconds, all relays fail to return a response. Therefore, the experiment started with a 10-second waiting period, decreasing it incrementally until a relay could return a correct response, at which point this timeout was saved as the maximum timeout.

[0115]

[0116] The experiment revealed that some relays and servers could not communicate with each other. Therefore, in order to avoid errors in the detection results caused by communication failures between relays and servers, it is necessary to first detect the connectivity between relays and servers. Each relay corresponds to a set of connected servers, and during the detection, a server is selected from this set and paired with it.

[0117] Experimental results show that the timeout time for most relays is around 9 seconds, accounting for approximately 87.3%, while about 4.5% of relay requests time out to less than 1 second or fail to connect. Figure 12 (represented by 0 in the middle).

[0118] Based on the maximum client request timeout detected for each relay, a mapping can be constructed from the relay to its maximum client timeout, which serves as the maximum request delay time in the request queue.

[0119] Traffic flattening techniques based on request queuing

[0120] If the sending time is deduced from the request latency of each SR pair, it might lead to some time points having no suitable requests while other time points accumulate a large number of requests, resulting in a waste of bandwidth resources. To maximize bandwidth utilization, attackers need to select available SR pairs to send request messages at each time point and ensure that the load distribution is even across each SR pair path. Therefore, flattening the request sequence is necessary.

[0121] Assuming the message arrival time is "arrive", the current time is "t", and the server's maximum timeout is "delay"... max Minimum one-way request delay stt min Maximum one-way request latency stt max .

[0122] First, consider the minimum time t, which is the lower bound of t. To ensure the message arrives within the specified time, the attacker needs to extend the transmission time of the request message along the path as much as possible, and the path transmission time... It is obtained by adding the one-way delay (stt) and the request queuing time (delay), that is:

[0123] (3)

[0124] Therefore:

[0125] (4)

[0126] Secondly, consider the upper limit, which means sending data packets as quickly as possible so that for the same request delay, the request message can be sent later:

[0127] (5)

[0128] stt min and stt max Replace the variable with stt, and consider the basic constraints:

[0129] (6)

[0130] The following linear programming problem is obtained ( Figure 13 ):

[0131] (7)

[0132] For time t, we need to find the range of stt that satisfies the conditions. Let the range of stt that satisfies the conditions at time t be [r min ,r max From the image, we can deduce that:

[0133] (8)

[0134] Based on the above, and combined with Algorithm 1, the following request flattening algorithm can be designed:

[0135]

[0136] Figure 14 It can be seen that the STT distribution of each path is not uniform, exhibiting clustering characteristics, with most STT values ​​concentrated between 300 and 800. This distribution may result in missing STT values ​​within certain time windows when constructing the request sequence. These gaps can be effectively filled by using a custom request queuing time through request flattening techniques. Figure 14 The comparison of sender bandwidth before and after request flattening is shown. It is clear that after request flattening, the sender's attack window is expanded, the curve is smoother, and thus more efficient use of the attacker's bandwidth is achieved.

[0137] Implementation examples of the system:

[0138] The anonymous DNS lens pulse DDoS attack system is based on DNSCrypt-Proxy and includes a request scheduler, a traffic generator (DNSCrypt proxy), and a traffic analyzer (target authority). The request scheduler, implemented in Python, performs latency probing and path time scheduling before sending attack traffic to maximize attack effectiveness. The traffic generator, a modified version of DNSCrypt-Proxy written in Golang, adds request queuing and DoS attack functionality. The traffic analyzer, implemented in Scapy, is an authority server with packet capture capabilities, capable of statistically analyzing received traffic and providing one-way latency calculation. The database uses MongoDB for storing and querying relay client timeouts and path latency.

[0139] This invention establishes an internet-based environment and conducts experiments in the real world to test lens-pulse DDoS attacks based on anonymous DNS, assessing the potential impact of the attack. To overcome the limitations of machine-based lending in the real environment, the effectiveness of packet amplification technology is verified in a simulated environment.

[0140] In terms of attack mitigation experiments, this invention used ns.py to simulate discrete events in the experimental environment and conducted experiments on a local Windows 11 machine. The impact of reducing relay cascade length and client request timeout on attack effectiveness was investigated. The differences in request distribution and peak amplification factor under different cascade layers and request timeout times were simulated, verifying the effectiveness of the mitigation method.

[0141] Experimental environment

[0142] This invention uses AWS EC2 cloud servers as both anonymous DNS pulse DDoS attack machines and target machines. Performance information is shown in the table below:

[0143] Table 2. Server Configuration for Pulse DDoS Attacks

[0144]

[0145] Using a Windows 11 machine as a discrete event simulation machine:

[0146] Table 3 Discrete Event Simulation Server Configuration

[0147]

[0148] This invention uses the ns.py discrete-time simulation framework to simulate the latency and jitter of different paths, and introduces Gaussian noise to simulate a real network environment. Figure 15 As shown, the simulation environment consists of four parts: a pulse flow generator, a Gaussian delay jitter link, a multi-layer lens simulator, and a simulation result generator.

[0149] (1) The path delay generator is responsible for generating packets with different delays based on the input μ and σ, as well as the maximum and minimum values. The generator uses a Gaussian distribution to simulate real-world link delays. Here, σ represents the standard deviation of the delay. The larger the value, the worse the current network environment and the higher the jitter.

[0150] (2) The request path scheduler sorts the path delays and uses the pulse attack request scheduling algorithm to schedule the data packets sent to each path. It calculates the request interval according to different algorithms, such as using the request flattening algorithm to queue the requests.

[0151] (3) The multilayer lens simulator is responsible for constructing different paths based on the number of lens layers and the number of paths input. In each layer, it performs a Cartesian product with all links in the next layer to expand the link delay range and simulate the relay cascading situation.

[0152] (4) The simulation result generator processes and statistically analyzes the experimental data, records the sending and receiving times of all data packets, plots the data packet distribution at the sending and receiving ends, calculates the magnification factor, and displays it on the image.

[0153] Reduce relay cascade length

[0154] Because anonymous DNS cascading technology was proposed relatively late, it has not been used by major DNS software. In order to explore the mitigation effect of reducing relay cascading length on attacks, the experiment conducted simulation tests on multiple different cascading levels in a discrete event simulation environment.

[0155] Each relay in each layer is cascaded with all relays in the next layer to form a path. Assuming the number of relays in the i-th layer is x, and the number of cascaded layers is n, then the total number of paths generated is... Therefore, the larger the cascading hierarchy, the greater the total number of paths, and thus the larger the latency range. For example... Figure 16 As shown, the time it takes for the receiving end to receive the pulse increases with the number of relay cascading levels. This is because a larger delay range provides a larger window for attackers to accumulate traffic. However, as the number of cascading levels increases, delay jitter also tends to accumulate. Too many cascading levels will cause the traffic received from the receiving end to become more dispersed, thus reducing the amplification effect. Figure 16 As shown, although the final receiver traffic distribution range is roughly equal across different cascade levels in the images, the horizontal axis scale differs. For example, when the cascade level is 2, the horizontal axis scale is 2000, while when the cascade level is 5, the horizontal axis scale is 2500. Therefore, as the cascade level increases, the attack window becomes larger, resulting in a larger receiver traffic distribution range. This means that latency jitter accumulates as the cascade level increases.

[0156] Table 4 Comparison of magnification effects under different cascade lengths

[0157]

[0158] Using message frequency as a reference (Table 4), the amplification effect is 3.25 times when the cascading level is 2 layers; however, when the cascading level gradually increases to 5 layers, the amplification effect reaches 15.67 times, showing a monotonically increasing trend. This is because, as the number of cascading layers increases, the latency window formed by different paths becomes larger, thus giving attackers more preparation time and allowing them to gather more traffic to send to the other end simultaneously. Therefore, it can be concluded that the larger the relay cascading level, the greater the amplification effect; conversely, reducing the relay cascading length can significantly mitigate the impact of attacks.

[0159] Reduce client request timeout

[0160] Client request timeout is a key factor in anonymous DNS protocol request queuing. Longer timeouts provide attackers with a larger window of opportunity, allowing them to accumulate more attack traffic over a longer period, thus significantly improving attack effectiveness. The impact of shortening client request timeouts on mitigating attack effectiveness was tested using a discrete event simulation environment.

[0161] like Figure 17 As shown, with the increase in client request timeout, the sender's available time to send also increases, a result of the request flattening effect. This flattening effect allows the sender to fully utilize its bandwidth. Simultaneously, the sender's time window gradually lengthens, enabling attackers to aggregate larger-scale attack traffic over a longer period, thus significantly amplifying the attack's impact.

[0162] Unlike the enhanced attack effect caused by relay cascading, request queuing does not cause the dispersion of receiver traffic. This is because path latency is not affected by request queuing time, and the algorithm can always accurately calculate the arrival time of packets, ensuring a high concentration of attack traffic. As shown in Table 5, the maximum fixed sender packet frequency in the experiment was 100 packets per second. When the maximum client timeout was 10 milliseconds, the packet frequency amplification factor was only 6x, while when the maximum client timeout reached 9000 milliseconds, the packet frequency amplification factor reached 240x. This shows that shortening the maximum client timeout can greatly alleviate the effect of pulse DDoS attacks based on anonymous DNS protocol request queuing.

[0163] Table 5 Comparison of magnification effect under different request timeout times.

[0164]

[0165] It should be understood that the various processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this application can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this application can be achieved, they are all within the protection scope of this invention.

[0166] The following is a list of references cited in this invention:

[0167] [1] Whyte D, Kranakis E, Oorschot P V.DNS-based Detection of ScanningWorms in an Enterprise Network[C] / / Network & Distributed System SecuritySymposium.2005.

[0168] [2]Lu C, Liu B, Li Z,et al.An End-to-End, Large-Scale Measurement ofDNS-over-Encryption: How Far Have We Come?[J]. Proceedings of the InternetMeasurement Conference, 2019.

[0169] [3]Reddy T, Gillmor D, Dickinson S.Usage Profiles for DNS over TLSand DNS over DTLS[J]. 2018.

[0170] [4]Huitema C , Dickinson S , Mankin A .DNS over Dedicated QUICConnections[J].RFC, 2022, 9250:1-27.

[0171] [5]Kurihara J , Kubo T .Mutualized oblivious DNS ($\\mu$ODNS): Hidinga tree in the wild forest[J]. 2021.

[0172] [6]Valkola, T.. Improvements to DNS privacy and integrity[C]. 2023

[0173] [7] Böttger T, Cuadrado F, Antichi G, et al. An Empirical Study ofthe Cost of DNS-over-HTTPS.[C] Proceedings of the Internet MeasurementConference. 2019: 15-21.

[0174] [8]Xing Y, Shu H, Zhao H, et al. Survey on botnet detectiontechniques: Classification, methods, and evaluation[J]. Mathematical Problemsin Engineering, Wiley Online Library, 2021, 2021(1): 6640499.

[0175] [9]Shen Z-Y, Su M-W, Cai Y-Z, et al. Mitigating SYN Flooding and UDPFlooding in P4-based SDN[C]. 2021 22nd Asia-Pacific Network Operations andManagement Symposium (APNOMS). 2021: 374-377.

[0176]

[10] Gupta N, Jain A, Saini P, et al. DDoS attack algorithm using ICMPflood[C]. 2016 3rd International Conference on Computing for SustainableGlobal Development (INDIACom). 2016: 4082-4084.

[0177]

[11] Kasim O. A Robust DNS flood attack detection with a hybriddeeper learning model[J]. Computers and Electrical Engineering, Elsevier,2022, 100: 107883.

[0178]

[12] Scholz D, Gallenmuller S, Stubbe H, et al. SYN flood defense inprogrammable data planes[C]. Proceedings of the 3rd P4 Workshop in Europe.2020: 13-20.

[0179]

[13] Yihunie F, Abdelfattah E, Odeh A. Analysis of ping of death DoSand DDoS attacks[C]. 2018 IEEE Long Island Systems, Applications andTechnology Conference (LISAT). 2018: 1-4.

[0180]

[14] Hartanto S. The Impact of Smurf Attack on Web Server inCommunication Network and its Preventions[J]. International Journal ofSustainable Applied Sciences (IJSAS), Multitech Publisher, 2023, 1(1): 35-46.

[0181]

[15] Razumov P V, Safaryan O A, Smirnov I A, et al. Developing ofalgorithm of HTTP FLOOD DDoS protection[C]. 2020 3rd International Conferenceon Computer Applications & Information Security (ICCAIS). 2020: 1-6.

[0182]

[16] Rios V, Inacio P, Magoni D, et al. Detection of Slowloris Attacksusing Machine Learning Algorithms[C]. Proceedings of the 39th ACM / SIGAPPSymposium on Applied Computing. 2024: 1321-1330.

[0183]

[17] Bushart J. Optimizing Recurrent Pulsing Attacks usingApplication-Layer Amplification of Open DNS Resolvers[C]. 12th USENIXWorkshop on Offensive Technologies (WOOT 18). 2018.

[0184]

[18] Bortzmeyer S, Huque S. NXDOMAIN: there really is nothingunderneath[R]. 2016.

[0185]

[19] Afek Y, Bremler-Barr A, Shafir L. NXNSAttack: Recursive DNSInefficiencies and Vulnerabilities[C]. 29th USENIX Security Symposium (USENIXSecurity 20). 2020: 631-648.

[0186]

[20] Luo X, Chang R K, others. On a new class of pulsing denial-of-service attacks and the defense.[C]. NDSS. 2005.

[0187]

[20] Guo R, Li W, Liu B, et al. CDN Judo: Breaking the CDN DoSProtection with Itself.[C]. NDSS. 2020.

[0188]

[22] Guo R, Chen J, Wang Y, et al. Temporal CDN-Convex Lens: A CDN-Assisted Practical Pulsing DDoS Attack[C]. 32nd USENIX Security Symposium(USENIX Security 23). 2023: 6185-6202.

[0189]

[23] Park J, Eom Y I. Fragpicker: A new defragmentation tool formodern storage devices[C]. Proceedings of the ACM SIGOPS 28th Symposium onOperating Systems Principles. 2021: 280-294.

[0190]

[24] Choi B.Linux Fundamentals II–TCP / IP Services[M] / / Introduction toPython Network Automation Volume I-Laying the Groundwork: The EssentialSkills for Growth. Berkeley, CA: Apress, 2024: 475-559.

[0191]

[25] Deering S, Hinden R. RFC 8200: Internet protocol, version 6(ipv6) specification[J]. RFC Editor, 2017.

[0192]

[26] Krishnan S. Handling of overlapping IPv6 fragments[R]. 2009.

[0193]

[27] Bonica R, Baker F, Huston G, et al. IP fragmentation consideredfragile[J]. RFC 8900, 2020.

[0194]

[28] BOSMA J, OVEREINDER B, TOOROP W. Discovering Path MTU black holeson the Internet using RIPE Atlas[J]. 2012.

[0195]

[29] Van Den Broek G, van Rijswijk-Deij R, Sperotto A, et al. DNSSECmeets real world: dealing with unreachability caused by fragmentation[J].IEEE communications magazine, IEEE, 2014, 52(4): 154-160.

[0196]

[30] Brandt M, Dai T, Klein A, et al. Domain validation++ for mitm-resilient pki[C]. Proceedings of the 2018 ACM SIGSAC Conference on Computerand Communications Security. 2018: 2060-2076.

[0197]

[31] Petr Špaček, CZ.NIC, Ondřej Surý., DNS flag day 2020, October2020. https: / / dnsflagday.net / 2020 /

[0198]

[32] Lucas T, Ferreira M, Plachta R, et al. Non-fragmented networkflow design analysis: Comparison ipv4 with ipv6 using path mtu discovery[J].Computers, Mdpi, 2020, 9(2): 54.

[0199]

[33] Alomari E, Manickam S, B. Gupta S B and Karuppayah, et al.Botnet-based distributed denial of service (DDoS) attacks on web servers:Classification and art[J]. Int. J. Comput. Appl., Foundation of ComputerScience, 2012, 49(7): 24-32.

[0200]

[34] McCoy D, Bauer K, Grunwald D, et al. Shining light in darkplaces: Understanding the Tor network[C]. Privacy Enhancing Technologies: 8thInternational Symposium, PETS 2008 Leuven, Belgium, July 23-25, 2008Proceedings 8. 2008: 63-76.

Claims

1. A defense method against pulse DDoS attacks based on anonymous DNS protocol, characterized in that, The method includes: 1) Construct a threat model for anonymous DNS time-lensing pulse DDoS attacks. Assume that the attacker has the ability to spoof identities, schedule requests, and control domain facilities. The attacker creates their own domain on an authoritative server provider and adds relevant records to launch the attack, or adds large TXT records to consume server traffic. 2) Multi-layer time lensing based on relay servers expands the attack window, thereby focusing more attack traffic. A relay-server time lensing technique is proposed, which increases the number of intermediate server layers to multiple layers, thereby expanding the latency range and improving the effectiveness of pulse attacks. The relay-server lens replaces the CDN server with an intermediate proxy relay and anonymous DNS server, changing from a single-layer lens to a double-layer lens. The request message type is either TCP or UDP in the anonymous DNS protocol. The relay and anonymous DNS servers can construct different paths and focus the traffic generated by multiple paths to arrive at the same time. 3) Relay cascading based on anonymous DNS protocol increases latency range and expands the attack window. Relay cascading based on the anonymous DNS protocol utilizes the characteristics of the μODNS protocol to cascade different numbers of relays, thereby increasing path latency and extending latency range. This protocol enhances privacy by cascading intermediate proxy servers, allowing attackers to conceal their identities. It can also expand the attack window by cascading multiple relays, turning the original single-layer relay into multiple layers, resulting in longer paths and larger attack windows. Furthermore, it can be used to create more diverse paths, enabling the storage of more attack traffic and the generation of higher-intensity pulses. 4) Request queuing based on client timeout By leveraging the client request timeout period of the anonymous DNS protocol, request latency can be precisely controlled, thereby gaining a larger attack window; Request queuing is divided into a preparation phase and a pulse phase. In the preparation phase, assuming the length of the request message is n bytes, the attacker first sends n-1 bytes of the request to the relay. Since the relay has a client request timeout period, it will store the first n-1 bytes of the request in memory and wait for the client to send the last byte. Once the relay receives the last byte, it will immediately forward the request to the anonymous DNS server. The client can arbitrarily specify how long to send the last byte. The client uses the last byte to "command" when the relay sends the entire request message. Detect the timeout period of open anonymous DNS relays across the entire network; To avoid errors in probe results caused by communication failures between relays and servers, the connectivity between relays and servers is first checked. Each relay corresponds to a set of connected servers, and during the probe, a server is selected from this set and paired with it. Based on the maximum client request timeout detected for each relay, a mapping is constructed from the relay to its maximum client timeout, which is used as the maximum request delay time in the request queue. 5) Flatten the request sequence. Attackers need to select available SR pairs at each time point to send request messages and ensure that the load distribution of each SR pair path is even, flattening the request sequence to maximize bandwidth utilization.

2. The defense method against pulse DDoS attacks based on anonymous DNS protocol according to claim 1, characterized in that, The attacker possesses the ability to impersonate an identity, schedule requests, and control domain infrastructure, specifically: Identity spoofing capability: Attackers can impersonate legitimate users and use anonymous DNS protocols to send low-rate legitimate traffic to different relays. For lens pulse attacks that utilize anonymous DNS relays, attackers only need to launch the attack from a single probe point, which can be any low-rate device, without relying on a botnet with bandwidth greater than or equal to that of the victim. The victim's server can only see the IP address of the anonymous DNS server, but does not know the IP address of the client, and cannot filter by the client's IP address. Request scheduling capability: Attackers pre-measure the round-trip latency of each relay and server relative to themselves, construct a server latency table, and request the sending order and time interval, so that the attack traffic can accurately reach the target host at the same time; Malicious attackers can design different relay-server paths or cascade multiple relays to form traffic with diverse latency characteristics, significantly expanding the attack window. Domain facility control capabilities: Attackers gain control of the domain name provided by the target authoritative server and can add specific records through the domain name to launch attacks. They also use large TXT records to consume server bandwidth and enhance the attack effect.

3. A defense method against pulse DDoS attacks based on anonymous DNS protocol according to claim 1 or 2, characterized in that, A relay-server time lensing technique is proposed, which increases the number of intermediate server layers to two to extend the latency range and improve pulse attack capabilities. The basic process of an anonymous DNS time lensing pulse DDoS attack is as follows: Step 1: The attacker randomly pairs anonymous DNS relays with the target server, generating different paths in the order of "number of relays × number of servers"; Step 2: The attacker performs latency measurement on the generated paths to obtain the round-trip time (RTT) for each path; Step 3: Calculate the one-way delay of each path by fitting the one-way delay, and select the path with smaller variance as the candidate path to ensure delay stability. Step 4: Combining traffic amplification technology with attack window expansion, the attacker carefully designs the request sequence based on the one-way latency of the candidate paths, so that requests sent along different paths can arrive at the target server Target at the same time. Step 5: Following a pre-constructed sequence of requests, the attacker sends DNS requests at a low rate to different paths; Step 6: Due to the focusing effect of the RS lens, traffic arrives at the target server simultaneously, forming a pulsed traffic peak, which in turn leads to service instability and resource exhaustion.

4. The defense method against pulse DDoS attacks based on anonymous DNS protocol according to claim 3, characterized in that, The attack flow of a relay-cascaded anonymous DNS pulse DDoS attack is as follows: Preparation phase: (1) The attacker modifies the configuration file of the anonymous DNS client to construct paths with different numbers of relays, thereby maximizing the use of the latency range; (2) The attacker combines relays of different cascade lengths with all servers by performing Cartesian product combinations to construct a path list; (3) The attacker uses low-frequency latency detection technology to measure the latency of each group of paths and sorts them from low to high; (4) The attacker uses one-way latency fitting technology to fit the one-way request latency of each group of paths and filters out paths with variance less than the threshold to add to the filtered list. Attack Phase: Attackers utilize request sequence scheduling algorithms and traffic amplification techniques to send requests sequentially from highest to lowest path latency according to a pre-constructed request sequence. The entire attack path includes the anonymous DNS protocol layer and the DNS protocol layer, with the final traffic reaching the target authoritative server. At the anonymous DNS protocol layer, attackers use encrypted TCP traffic to transmit data to prevent man-in-the-middle eavesdropping, thereby concealing their identity and increasing the difficulty of tracing the source. At the DNS protocol layer, the traffic is converted to plaintext UDP format. After relay cascading, the latency fluctuation is the sum of the latency fluctuations between multiple relays. For any cascaded path, we have: （1） Where r represents a relay, and R is the set of all relays. To request queuing delay, is the average delay per hop of the relay, and jitter is the jitter per hop; the first two terms in the formula are constants, and the third term is white noise.

5. A defense method against pulse DDoS attacks based on anonymous DNS protocol according to claim 4, characterized in that, The request queuing method allows attackers to construct request sequences as follows: for a single SR path, if its one-way request latency is stt, the maximum client request timeout for the relay is... The server receiving time is set to Assuming the number of requests constructed is n, the request interval can be set arbitrarily. The transmission time sequence is then: （2） ， A single path can construct a sequence of n+1 requests, and in addition, the sending time window will be changed from the original... Expanded to .

6. A method for defending against pulse DDoS attacks based on anonymous DNS protocol according to claim 5, characterized in that, The timeout period for all open anonymous DNS relays on the network is detected as follows: For each anonymous DNS relay, a connected path is selected. After sending the first n-1 bytes of the data packet, the last byte is sent after a different waiting time. If the relay returns a correct response, the timeout period is considered valid. When the timeout period reaches the set value, all relays will fail to return a response. The waiting time is gradually reduced from the set value until a relay can return a correct response. This timeout period is then saved as the maximum timeout period.

7. A defense method against pulse DDoS attacks based on anonymous DNS protocol according to claim 5 or 6, characterized in that, The specific process of flattening the request sequence is as follows: Assuming the message arrival time is "arrive", the current time is "t", and the server's maximum timeout is "delay"... max Minimum one-way request delay stt min Maximum one-way request latency stt max ; First, consider the minimum time t, which is the lower boundary of t. To ensure the message arrives within the specified time, the attacker needs to extend the transmission time of the request message along the path as much as possible, and the path transmission time... It is obtained by adding the one-way delay (stt) and the request queuing time (delay), that is: （3） Therefore: （4） Secondly, consider the upper boundary to send data packets faster, so that for the same request delay, request messages can be sent later: （5） stt min and stt max Replace the variable with stt, and consider the basic constraints: （6） The following linear programming problem is obtained: （7） For time t, we need to find the range of stt that satisfies the conditions. Let the range of stt that satisfies the conditions at time t be [r min ,r max From the image, we can deduce that: （8）。 8. A method for defending against pulse DDoS attacks based on anonymous DNS protocol according to claim 1 or 7, characterized in that, When queuing requests based on client timeouts, the client request timeout time of the anonymous DNS protocol can be used to precisely control request latency, and IP fragmentation can be combined to achieve a larger attack window.

9. A defense system against pulse DDoS attacks based on anonymous DNS protocol, characterized in that: The system has a program module corresponding to the steps of any one of claims 1-8. When the program module is run, it executes the steps in the method for defending against burst DDoS attacks based on anonymous DNS protocol.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program configured to, when invoked by a processor, implement the steps of the defense method against burst DDoS attacks based on the anonymous DNS protocol as described in any one of claims 1-8.

Images