DNS Query Filtering With Cuckoo Filters Against Water Torture DDoS
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
DNS servers are vulnerable to 'water torture' DDoS attacks, which overwhelm the servers with queries that cause extra processing and network requests, leading to failure in responding to legitimate queries.
Innovation Solution
Implement a monitoring device that uses probabilistic data structures, such as cuckoo filters, to validate DNS queries before they reach the server, intercepting and filtering out queries for unknown domain names, and employing countermeasures like rate limiting and regular expression filtering.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If DNS servers process all incoming queries without filtering, then all legitimate queries can be answered, but the server becomes vulnerable to DDoS attacks and experiences excessive processing load
Solution Approach 1:
The system performs preliminary actions by building a probabilistic data structure (cuckoo filter) containing domain names from the server's cache before the DDoS attack occurs. This pre-populated filter enables rapid validation of incoming queries during the attack, allowing the server to quickly identify and handle legitimate queries while rejecting malicious ones, thus maintaining service availability under attack conditions
Solution Approach 2:
The patent introduces an intermediary mechanism (probabilistic data structure/cuckoo filter) between the incoming queries and the DNS server processing. This intermediary rapidly checks domain names against the pre-built filter to determine if they are likely legitimate, thereby protecting the DNS server from direct exposure to DDoS attack traffic while still allowing legitimate queries to pass through for processing
2Productivity
If DNS servers cache domain names for efficient processing, then legitimate queries are answered quickly, but malicious queries with unknown domain names cause extra processing and network requests
Solution Approach 1:
The system performs preliminary action by extracting domain names from the DNS server's cache and storing them in a cuckoo filter before the attack begins. This pre-processing creates a ready-to-use validation structure that enables O(1) average time complexity lookups during the attack, maintaining high query processing speed without the overhead of complex real-time validation algorithms
Solution Approach 2:
The patent employs a probabilistic data structure (cuckoo filter) that is computationally inexpensive to query and can be rapidly updated or discarded. This disposable-like structure provides efficient validation during the attack window without requiring long-term maintenance or complex management, reducing processing overhead while maintaining productivity
3Object-affected harmful factors
If a monitoring device validates all DNS queries before they reach the server, then the server is protected from DDoS attacks, but the validation process itself adds processing overhead and potential delay
Solution Approach 1:
The patent replaces complex mechanical validation systems with a probabilistic data structure (cuckoo filter) that enables extremely fast O(1) average time complexity lookups. This substitution eliminates the need for intricate validation algorithms, multi-step verification processes, or complex decision trees, thereby minimizing validation time while maintaining effective attack traffic filtering
Solution Approach 2:
The system changes the parameter of validation time by using a data structure specifically optimized for constant-time lookups. The cuckoo filter's design parameters (hash functions, table size, load factor) are configured to provide the fastest possible validation speed, reducing the time loss introduced by the monitoring device while maintaining high filtering effectiveness
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A system is disclosed. The system can include a network monitoring device connected to a communications network. The network monitoring device to store a probabilistic data structure indicating one or more domain names; receive a response data packet from the DNS server, the response data packet comprising a first domain name transmitted in a query to the DNS server and an affirmative response code; update the probabilistic data structure with the first domain name identified from the response data packet; responsive to detecting an attack on the network, retrieve a query message, the query message containing a second domain name; query the updated probabilistic data structure with the second domain name; and restrict transmission of the query message or communication by the computing device with the DNS server.