DNS放大攻擊利用UDP無連線特性與來源位址可偽造性，透過公開DNS解析器以小型查詢觸發大型回應並反射至目標，對公開UDP服務造成嚴重負載。 本研究提出DASSH（DNS Amplification Scaling Shield），一種部署於應用層服務入口的負載平衡多代理防禦架構，用以強制執行DNS查詢與回應的一致性。系統由對外的負載平衡器與多個代理節點組成，代理節點透過核心層的連線狀態追蹤機制阻擋未經請求的DNS回應，並於應用層結合DNS查詢追蹤機制，確保僅有本節點主動發起之查詢回應能被放行。 透過容器化實驗環境驗證，結果顯示在DNS放大攻擊情境下，DASSH能有效隔離未經請求的放大回應流量，使後端UDP服務於攻擊期間仍維持正常運作，且無需修改既有 DNS協定或外部網路基礎設施。;DNS amplification attacks exploit the stateless nature of UDP and source IP spoofing to reflect amplified DNS responses toward victims, imposing severe load on UDP-based services. DASSH, an application-layer, load-balanced multi-proxy defense that enforces DNS query–response consistency at the service entry point. The system consists of a public load balancer and multiple independent proxy nodes. Each proxy blocks unsolicited DNS responses using kernel-level connection state tracking and application-layer DNS query validation, allowing only responses corresponding to queries issued by the same proxy. Experiments conducted in a containerized environment demonstrate that DASSH effectively isolates amplified DNS response traffic and preserves the availability of backend UDP services during DNS amplification attacks, without requiring modifications to the DNS protocol or external network infrastructure.
