Investigating the impact of DDoS attacks on DNS infrastructure

Raffaele Sommese; Kimberley Claffy; Roland Martijn van Rijswijk - Deij; Arnab Chattopadhyay; Alberto Dainotti; Anna Sperotto; Mattijs Jonker

doi:10.1145/3517745.3561458

Investigating the impact of DDoS attacks on DNS infrastructure

Raffaele Sommese, Kimberley Claffy, Roland Martijn van Rijswijk - Deij, Arnab Chattopadhyay, Alberto Dainotti, Anna Sperotto, Mattijs Jonker

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

9 Citations (Scopus)

134 Downloads (Pure)

Abstract

Denial of Service (DDoS) attacks both abuse and target core Internet infrastructures and services, including the Domain Name System (DNS). To characterize recent DDoS attacks against authoritative DNS infrastructure, we join two existing data sets – DoS activity inferred from a sizable darknet, and contemporaneous DNS measurement data – for a 17-month period (Nov. 20 - Mar. 22). Our measurements reveal evidence that millions of domains (up to 5% of the DNS namespace) experienced a DoS attack during our observation window. Most attacks did not substantially harm DNS performance, but in some cases we saw 100-fold increases in DNS resolution time, or complete unreachability. Our measurements captured a devastating attack against a large provider in the Netherlands (TransIP), and attacks against Russian infrastructure. Our data corroborates the value of known best practices to improve DNS resilience to attacks, including the use of anycast and topological redundancy in nameserver infrastructure. We discuss the strengths and weaknesses of our data sets for DDoS tracking and impact on the DNS, and promising next steps to improve our understanding of the evolving DDoS ecosystem.

Original language	English
Title of host publication	Proceedings of the 22nd ACM Internet Measurement Conference
Publisher	Association for Computing Machinery
Pages	51-64
Number of pages	14
ISBN (Electronic)	9781450392594
DOIs	https://doi.org/10.1145/3517745.3561458
Publication status	Published - 25 Oct 2022
Event	22nd ACM Internet Measurement Conference, IMC 2022 - Nice, France Duration: 25 Oct 2022 → 27 Oct 2022 Conference number: 22 https://conferences.sigcomm.org/imc/2022/

Conference

Conference	22nd ACM Internet Measurement Conference, IMC 2022
Abbreviated title	IMC 2022
Country/Territory	France
City	Nice
Period	25/10/22 → 27/10/22
Internet address	https://conferences.sigcomm.org/imc/2022/

UN SDGs

This output contributes to the following UN Sustainable Development Goals (SDGs)

Access to Document

10.1145/3517745.3561458Licence: CC BY

ArticleFinal published version, 1.36 MBLicence: CC BY

Cite this

@inproceedings{106eca08f1d545aeb4235af01b60acc7,

title = "Investigating the impact of DDoS attacks on DNS infrastructure",

abstract = "Denial of Service (DDoS) attacks both abuse and target core Internet infrastructures and services, including the Domain Name System (DNS). To characterize recent DDoS attacks against authoritative DNS infrastructure, we join two existing data sets – DoS activity inferred from a sizable darknet, and contemporaneous DNS measurement data – for a 17-month period (Nov. 20 - Mar. 22). Our measurements reveal evidence that millions of domains (up to 5% of the DNS namespace) experienced a DoS attack during our observation window. Most attacks did not substantially harm DNS performance, but in some cases we saw 100-fold increases in DNS resolution time, or complete unreachability. Our measurements captured a devastating attack against a large provider in the Netherlands (TransIP), and attacks against Russian infrastructure. Our data corroborates the value of known best practices to improve DNS resilience to attacks, including the use of anycast and topological redundancy in nameserver infrastructure. We discuss the strengths and weaknesses of our data sets for DDoS tracking and impact on the DNS, and promising next steps to improve our understanding of the evolving DDoS ecosystem.",

author = "Raffaele Sommese and Kimberley Claffy and {van Rijswijk - Deij}, {Roland Martijn} and Arnab Chattopadhyay and Alberto Dainotti and Anna Sperotto and Mattijs Jonker",

note = "Funding Information: We thank our shepherd Mark Allman and the anonymous IMC reviewers for their insightful suggestions and feedback. This work is partially funded by the NWO-DHS MADDVIPR project (Grant Agreement 628.001.031/FA8750-19-2-0004) and the EU CONCOR-DIA project (Grant Agreement 830927). This work included funding awards from U.S. NSF (OAC-2131987, CNS-2120399, CNS-1705024, CNS-2202288). The views and conclusions contained herein are those of the authors and should not be interpreted as necessarily representing the official policies or endorsements, either expressed or implied, of NSF, DHS, or the U.S. government. Funding Information: We thank our shepherd Mark Allman and the anonymous IMC reviewers for their insightful suggestions and feedback. This work is partially funded by the NWO-DHS MADDVIPR project (Grant Agreement 628.001.031/FA8750-19-2-0004) and the EU CONCORDIA project (Grant Agreement 830927). This work included funding awards from U.S. NSF (OAC-2131987, CNS-2120399, CNS-1705024, CNS-2202288). The views and conclusions contained herein are those of the authors and should not be interpreted as necessarily representing the official policies or endorsements, either expressed or implied, of NSF, DHS, or the U.S. government. Publisher Copyright: {\textcopyright} 2022 Copyright held by the owner/author(s).; 22nd ACM Internet Measurement Conference, IMC 2022, IMC 2022 ; Conference date: 25-10-2022 Through 27-10-2022",

year = "2022",

month = oct,

day = "25",

doi = "10.1145/3517745.3561458",

language = "English",

pages = "51--64",

booktitle = "Proceedings of the 22nd ACM Internet Measurement Conference",

publisher = "Association for Computing Machinery",

address = "United States",

url = "https://conferences.sigcomm.org/imc/2022/",

}

Sommese, R, Claffy, K, van Rijswijk - Deij, RM, Chattopadhyay, A, Dainotti, A, Sperotto, A & Jonker, M 2022, Investigating the impact of DDoS attacks on DNS infrastructure. in Proceedings of the 22nd ACM Internet Measurement Conference. Association for Computing Machinery, pp. 51-64, 22nd ACM Internet Measurement Conference, IMC 2022, Nice, France, 25/10/22. https://doi.org/10.1145/3517745.3561458

Investigating the impact of DDoS attacks on DNS infrastructure. / Sommese, Raffaele; Claffy, Kimberley; van Rijswijk - Deij, Roland Martijn et al.
Proceedings of the 22nd ACM Internet Measurement Conference. Association for Computing Machinery, 2022. p. 51-64.

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

TY - GEN

T1 - Investigating the impact of DDoS attacks on DNS infrastructure

AU - Sommese, Raffaele

AU - Claffy, Kimberley

AU - van Rijswijk - Deij, Roland Martijn

AU - Chattopadhyay, Arnab

AU - Dainotti, Alberto

AU - Sperotto, Anna

AU - Jonker, Mattijs

N1 - Conference code: 22

PY - 2022/10/25

Y1 - 2022/10/25

N2 - Denial of Service (DDoS) attacks both abuse and target core Internet infrastructures and services, including the Domain Name System (DNS). To characterize recent DDoS attacks against authoritative DNS infrastructure, we join two existing data sets – DoS activity inferred from a sizable darknet, and contemporaneous DNS measurement data – for a 17-month period (Nov. 20 - Mar. 22). Our measurements reveal evidence that millions of domains (up to 5% of the DNS namespace) experienced a DoS attack during our observation window. Most attacks did not substantially harm DNS performance, but in some cases we saw 100-fold increases in DNS resolution time, or complete unreachability. Our measurements captured a devastating attack against a large provider in the Netherlands (TransIP), and attacks against Russian infrastructure. Our data corroborates the value of known best practices to improve DNS resilience to attacks, including the use of anycast and topological redundancy in nameserver infrastructure. We discuss the strengths and weaknesses of our data sets for DDoS tracking and impact on the DNS, and promising next steps to improve our understanding of the evolving DDoS ecosystem.

AB - Denial of Service (DDoS) attacks both abuse and target core Internet infrastructures and services, including the Domain Name System (DNS). To characterize recent DDoS attacks against authoritative DNS infrastructure, we join two existing data sets – DoS activity inferred from a sizable darknet, and contemporaneous DNS measurement data – for a 17-month period (Nov. 20 - Mar. 22). Our measurements reveal evidence that millions of domains (up to 5% of the DNS namespace) experienced a DoS attack during our observation window. Most attacks did not substantially harm DNS performance, but in some cases we saw 100-fold increases in DNS resolution time, or complete unreachability. Our measurements captured a devastating attack against a large provider in the Netherlands (TransIP), and attacks against Russian infrastructure. Our data corroborates the value of known best practices to improve DNS resilience to attacks, including the use of anycast and topological redundancy in nameserver infrastructure. We discuss the strengths and weaknesses of our data sets for DDoS tracking and impact on the DNS, and promising next steps to improve our understanding of the evolving DDoS ecosystem.

U2 - 10.1145/3517745.3561458

DO - 10.1145/3517745.3561458

M3 - Conference contribution

SP - 51

EP - 64

BT - Proceedings of the 22nd ACM Internet Measurement Conference

PB - Association for Computing Machinery

T2 - 22nd ACM Internet Measurement Conference, IMC 2022

Y2 - 25 October 2022 through 27 October 2022

ER -

Investigating the impact of DDoS attacks on DNS infrastructure

Abstract

Conference

UN SDGs

Access to Document

Fingerprint

Cite this