Paper Info
Title
DDoS Attack Mitigation through Root-DNS Server: A Case Study
Abstract
Load balancing and IP anycast are traffic routing algorithms used to speed up delivery of the Domain Name System. In case of a DDoS attack or an overload condition, the value of these protocols is critical, as they can provide intrinsic DDoS mitigation with the failover alternatives. In this paper, we present a methodology for predicting the next DNS response in the light of a potential redirection to less busy servers, in order to mitigate the size of the attack. Our experiments were conducted using data from the Nov. 2015 attack of the Root DNS servers and Logistic Regression, k-Nearest Neighbors, Support Vector Machines and Random Forest as our primary classifiers. The models were able to successfully predict up to 83% of responses for Root Letters that operated on a small number of sites and consequently suffered the most during the attacks. On the other hand, regarding DNS requests coming from more distributed Root servers, the models demonstrated lower accuracy. Our analysis showed a correlation between the True Positive Rate metric and the number of sites, as well as a clear need for intelligent management of traffic in load balancing practices.
Year
DOI
Venue
2019
10.1109/SERVICES.2019.00025
2019 IEEE World Congress on Services (SERVICES)
Keywords
Field
DocType
Domain Name System, Root DNS, machine learning, DDoS, high availability, anycast, load balancing, Quality of Service, Cyber Security, RIPE Atlas
Data mining,Failover,Denial-of-service attack,Computer science,Load balancing (computing),Server,Domain Name System,Computer network,Root name server,Anycast,DDoS mitigation
Conference
Volume
ISSN
ISBN
2642-939X
2378-3818
978-1-7281-3852-7
Citations 
PageRank 
References 
0
0.34
9
Authors
3
Name
Order
Citations
PageRank
Betty Saridou100.34
Stavros Shiaeles221.07
Basil K. Papadopoulos300.68