LoopDart: Detecting and Filtering Repetitive Response Loops at the Application Layer

NCUIR > College of Electrical Engineering & Computer Science > Graduate Institute of Computer Science and Information Engineering > Electronic Thesis & Dissertation > Item 987654321/98221

Please use this identifier to cite or link to this item: https://ir.lib.ncu.edu.tw/handle/987654321/98221

Title:	LoopDart: Detecting and Filtering Repetitive Response Loops at the Application Layer
Authors:	吳嘉欣;Wu, Jia-Xin
Contributors:	資訊工程學系
Keywords:	阻斷服務攻擊;應用層流量迴圈;Denial-of-Service(DoS) attack;Application-Layer Traffic Loop
Date:	2025-07-12
Issue Date:	2025-10-17 12:30:40 (UTC+8)
Publisher:	國立中央大學
Abstract:	傳統阻斷服務（DoS）攻擊大多仰賴大量流量或是殭屍網路持續發送請求，達到癱瘓目標系統的目的。然而，本論文聚焦的一種新型攻擊——應用層流量迴圈（Application-Layer Traffic Loops）僅需要透過一個偽裝來源的觸發封包，即可誘發兩台伺服器間不斷地相互回應，最終耗盡資源或導致系統崩潰，形成幾乎「零成本、無須持續控制」的 DoS 攻擊。由於傳統的 DoS 防禦措施，如流量分析與頻率限制，難以防禦此類應用層迴圈攻擊，本論文專注於應用層流量迴圈在 DNS 協定中的防禦方式。我們首先重現攻擊流程，驗證僅透過特定錯誤回應即可在現有的 DNS 伺服器間引發流量迴圈。接著提出一套針對 DNS 伺服器的防禦機制，藉由短時間內重複錯誤回應的特徵進行判斷，即時阻擋潛在迴圈封包。實驗結果顯示，本系統能在不影響正常服務的前提下，達成 95% 以上的防禦準確率，有效提升 DNS 系統面對此類新型攻擊的防護能力。;Traditional Denial-of-Service (DoS) attacks often rely on high traffic volume or botnets continuously sending requests to overwhelm target systems. However, this thesis focuses on a novel attack technique, Application-Layer Traffic Loops, which can be triggered by a single spoofed packet, causing two servers to endlessly respond to each other. This leads to resource exhaustion or system crashes, forming an almost zero-cost, controlfree DoS attack. Since conventional DoS defense mechanisms, such as traffic analysis and rate limiting, are ineffective against this type of application-layer loop attack, this study concentrates on a defensive approach specifically for DNS-based traffic loops. We first replicate the attack process and verify that specific error responses alone are sufficient to induce looping behavior between DNS servers. Then, we propose a defense mechanism for DNS servers that detects short-term repetitive error responses and promptly blocks potential loop-inducing packets. The experimental results show that the proposed system can achieve a defense accuracy of over 95% without affecting normal services, effectively enhancing the DNS system’s ability to defend against this new type of attack.
Appears in Collections:	[Graduate Institute of Computer Science and Information Engineering] Electronic Thesis & Dissertation

Files in This Item:

File	Description	Size	Format
index.html		0Kb	HTML	12	View/Open

社群 sharing

Loading...