HELP4DNS: Leveraging the programmable data plane for effective and robust defense against DDoS attacks on DNS

Abstract

DNS is a critical component of the Internet infrastructure, and securing it has been an active research domain, with a particular emphasis on countering DDoS attacks. With the rise of programmable data planes, novel defensive strategies taking advantage of their flexibility and line-rate packet processing capabilities have been developed to counter a range of DDoS attacks. This study proposes two novel methodologies against DNS flood and DNS amplification attacks within programmable data planes using P4. The first approach involves constraining the concurrent active queries per client to mitigate DNS query flood attacks, thereby ensuring that clients generating a high volume of requests adhere to predetermined limits. The proposed method uses concurrent query limits per client by employing a modified token bucket algorithm within an updatable Bloom filter data structure to track and limit DNS queries. This approach effectively rate limits malicious client requests, preventing server overload and safeguarding benign users from any resulting disruptions. The second method is a DNS firewall implemented on the P4 switch situated on the victim’s side to prevent DNS amplification attacks. The proposed firewall utilizes an updatable Bloom filter on a P4 switch, enabling stateful processing of DNS queries at the application layer. Additionally, it supports stateful tracking of fragmented DNS responses resulting from the Extension Mechanisms for DNS. While IP fragmentation occurs at the IP layer, the proposed approach achieves stateful tracking of fragmented DNS responses at the application layer. In this manner, only the responses corresponding to legitimate requests are forwarded among the received DNS responses by the victim, while responses stemming from DNS amplification attacks are blocked. Evaluation results have demonstrated that the proposed approach effectively blocks high-volume DNS amplification attack packets with minimal memory space requirements.