| 摘要(英) |
In this paper, we propose a network-based solution, DNSPD, to defend an organization against the notorious DNS cache poisoning attack. DNS cache poisoning has been used to attack DNS servers since 1993 [1]. Through this type of attacks, an attacker can change the IP address of a domain name to any IP address chosen by her/him. Because an attacker can not obtain the transaction number and port number of a DNS query sent by a DNS resolver, in order to forge the related DNS response with a prepared IP address, the attacker needs to send many fake DNS response to the resolver, and all the fake DNS messages may have the same IP address. Based on this observation, DNSPD solves DNS cache poisoning by detecting, recording, and confirming the IP addresses appearing in contents of fake DNS replies. As a result, DNSPD not only can block DNS cache poisoning attacks but also can identify the malicious hosts which attackers plan for redirecting target hosts’ traffic. Usually these malicious hosts are botnet members and used as phishing sites; hence, identifying these bots and disconnecting traffic to them can provide further protection to the hosts in a network. Besides, through the utilization of Bloom Counter [2] and host confirmation, DNSPD maintains its detection accuracy even when it is bombarded with tremendous fake DNS replies. Experimental results show that with low performance overhead, DSNSP can accurate block DSN cache poisoning attacks and detect the related bots.
|
| 參考文獻 |
[1] Christoph Schuba, “ADDRESSING WEAKNESSES IN THE DOMAIN NAME SYSTEM PROTOCOL”, Master's thesis, Purdue University Department of Computer Sciences, (August 1993)
[2] L. Fan, P. Cao, J. Almeida, and A. Z. Broder. “Summary Cache: A
Scalable Wide-Area Web Cache Sharing Protocol.” IEEE/ACM Transactions on
Networking, Volume 8, Issue 3, Pages: 281 – 293, (June 2000).
[3] Dan Kaminsky, “Black Ops 2008: It's The End of The Cache As We Know It,” Black Hat USA 2008 presentation, (Aug. 2008).
[4] A. Hubert, R. van Mook, “Measures for Making DNS More Resilient against Forged Answers,” RFC 5452, (Jan. 2009).
[5] P. Mockapetris, “DOMAIN NAMES - CONCEPTS AND FACILITIES,” RFC 1034, (November 1987)
[6] P. Mockapetris, “DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION,” RFC 1035, (November 1987)
[7] DNSSEC: DNS Security Extensions Securing the Domain Name System. http://www.dnssec.net/
[8] R. Arends, R. Austein, M. Larson, D. Massey, S. Rose, “DNS Security Introduction and Requirements,” RFC 4033, (Mar. 2005)
[9] Andrew Kalafut, Minaxi Gupta , “Pollution Resilience for DNS Resolvers”, IEEE ICC, Dresden, Pages: 281 – 293, (June 2009).
[10] Hung-Min Sun, Wen-Hsuan Chang, Shih-Ying Chang, and Yue-Hsun Lin, “DepenDNS: Dependable Mechanism against DNS Cache Poisoning”, Lecture Notes in Computer Science, Volume 5888, Pages: 174–188, (2009)
[11] Fu-hau Hsu, Chang-kuo Tso, “A Browser-side Solution to Drive-by-Download-Based Malicious Web Pages”, Master's thesis, National Central University, (2009)
[12] Fu-hau Hsu, Chuan-sheng Wang, “Shark: Phishing Information Recycling from Spam Mails”, Master's thesis, National Central University, (2010)
[13] Alexa Top 500 Global Sites. http://www.alexa.com/topsites
[14] US-CERT, “Multiple DNS implementations vulnerable to cache poisoning”, Vulnerability Note VU#800113 (July, 2008)
|
[Endnote RIS 格式]
[相關文章]
[文章引用]
[完整記錄]
[館藏目錄]
至系統瀏覽論文 ( 永不開放)
plurk
funp
live
udn
HD
myshare
netvibes
friend
youpush
delicious
baidu
Google bookmarks
del.icio.us
hemidemi
facebook
twitter
google
reddit