DNS Response Filtering for Amplification Attack Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
DNS amplification attacks overwhelm target systems by sending small queries to DNS servers with spoofed IP addresses, causing large responses that consume bandwidth and render systems inaccessible.
Innovation Solution
A threat intelligence system analyzes network traffic to detect DNS amplification attacks by monitoring request rates and payload sizes, triggering filtering rules on routers or DNS servers to drop oversized responses, using machine learning to dynamically set threshold payload sizes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If DNS servers send large responses to all queries, then complete information is provided to clients, but network bandwidth is consumed and target systems become inaccessible during attacks
Solution Approach 1:
The patent changes the parameter of response payload size by introducing dynamic threshold-based filtering. DNS servers monitor traffic patterns and adjust the payload size parameter of responses based on detected attack conditions, sending full responses during normal operation but truncated responses during attacks to mitigate bandwidth consumption while preserving essential information
Solution Approach 2:
The system transitions from static response generation to dynamic response generation based on real-time traffic analysis. The DNS server dynamically adjusts response characteristics including payload size, filtering decisions, and rate limiting parameters based on current network conditions and detected attack patterns, allowing adaptive mitigation while maintaining service quality
2Reliability
If filtering rules are applied to drop oversized responses, then attack traffic is mitigated, but legitimate large responses may be blocked
Solution Approach 1:
The patent implements feedback mechanisms where DNS servers continuously monitor response patterns, client behavior, and traffic characteristics. This feedback loop allows the system to learn from observed traffic and dynamically adjust filtering thresholds and rate limiting parameters, ensuring that legitimate large responses are preserved while attack traffic is blocked based on contextual analysis rather than rigid size limits
Solution Approach 2:
The system applies different filtering characteristics to different sources and contexts. Instead of uniform filtering, the patent implements source-specific, query-type-specific, and time-specific filtering rules that adapt to local traffic characteristics, allowing legitimate large responses from trusted sources or specific query types to pass through while blocking malicious traffic with similar characteristics
3Loss of energy
If rate limiting is implemented to prevent amplification, then attack traffic is reduced, but query processing speed decreases
Solution Approach 1:
The patent applies partial rate limiting by implementing thresholds that allow a certain volume of queries to proceed at full speed before rate limiting kicks in. The system monitors query rates and applies progressive rate limiting actions, starting with logging and warnings, then selective filtering, and finally rate limiting only when thresholds are exceeded, thereby maintaining high processing speeds for normal traffic while mitigating attack volumes
Data Source
AI summary
Systems and methods for mitigating DNS amplification attacks are provided. In one example, a threat intelligence system collects data about the requests received by a DNS server, and/or responses generated by the DNS server. The threat intelligence system triggers a threat mitigation action upon detecting evidence (in one or more forms) of a DNS amplification attack. The threat mitigation action may include filtering DNS responses generated by the DNS server. The filtering rule may indicate that a DNS response in which the payload size is above a threshold payload size is to be dropped. In examples, the payload threshold size is dynamically set by the threat intelligence system using a machine learning model to minimize the filtering of DNS responses for valid DNS queries, while maximizing filtering of DNS responses for malicious DNS queries.