”網域名稱伺服器快取毒害”(DNS Cache Poisoning)自1993年被提出 [1]，迄今仍無法徹底解決，此攻擊會造成DNS主機的快取資料錯亂，而本該是連線到正常網站，會被導向至攻擊者的網站，導致一般使用者上當受害。而快取攻擊的原理是猜測先前送出查詢封包(query)中的資料，包含一個0~65535的亂數、連線的IP與Port Number等，回應的封包(response)若通過檢查，就會被視為是正確的答案，並儲存在快取中，以減輕下次查詢的時間；所以攻擊者通常會藉由發送大量的封包來提高猜中的機率。 我們根據此特性建構了一套有效的防範機制DNSPD，適合部署至一般大型組織、企業的網路架構來阻擋攻擊。根據觀察，這些偽造的DNS封包中，通常會含有惡意網站的IP，所以我們將IP取出，並紀錄與持續觀察是否有惡意行為，例如：釣魚網站等。而且這些IP通常也會是網路殭屍(botnet)的成員，我們更可藉由捕捉攻擊封包，建立botnet IP黑名單，提前預防其他潛藏的危機。另外，我們利用Counting Bloom filter [2]來確保DNSPD能有效的處理大量偽造封包；經過運作與測試的証實，DNSPD不僅能阻擋快取毒害的攻擊、找出botnet成員，更重要的是它對原本網路所增加的負擔極小。In this paper, we propose a network-based solution, DNSPD, to defend an organization against the notorious DNS cache poisoning attack. DNS cache poisoning has been used to attack DNS servers since 1993 [1]. Through this type of attacks, an attacker can change the IP address of a domain name to any IP address chosen by her/him. Because an attacker can not obtain the transaction number and port number of a DNS query sent by a DNS resolver, in order to forge the related DNS response with a prepared IP address, the attacker needs to send many fake DNS response to the resolver, and all the fake DNS messages may have the same IP address. Based on this observation, DNSPD solves DNS cache poisoning by detecting, recording, and confirming the IP addresses appearing in contents of fake DNS replies. As a result, DNSPD not only can block DNS cache poisoning attacks but also can identify the malicious hosts which attackers plan for redirecting target hosts’ traffic. Usually these malicious hosts are botnet members and used as phishing sites; hence, identifying these bots and disconnecting traffic to them can provide further protection to the hosts in a network. Besides, through the utilization of Bloom Counter [2] and host confirmation, DNSPD maintains its detection accuracy even when it is bombarded with tremendous fake DNS replies. Experimental results show that with low performance overhead, DSNSP can accurate block DSN cache poisoning attacks and detect the related bots.
