Abstrato

Protecting DNS Query Communication against DDoS Attacks

Ms. R. Madhuranthaki, Ms. S. Umarani, M.E., (Ph.D)

The server resources are abnormally consumed by the attackers using the denial-if service attacks. Denial-of- Service denies a victim from providing or receiving normal services. Distributed Denial of Service (DDoS) Attacks are generated in a “many to one” dimension. In DDoS attack model large number of compromised host are gathered to send useless service requests, packets at the same time. Attackers select the hidden channel model for their communication. A C&C channel for a botnet needs to be reliable, redundant, noncentralized and easily disguised as legitimate traffic. Domain Name Service (DNS) provides a distributed infrastructure for storing, updating and disseminating data. DNS is targeted as a stealthy botnet command-and-control channel. Malicious DNS activities are hiding at the network level. Exponentially Distributed Query and Piggybacking Query attacks are detected using the markov chain analysis and statistical analysis mechanism. Probability distribution based analysis model is used to detect automatic domain flux attacks. DNS tunneling technique is used for transmitting arbitrary data via DNS protocol. The attack detection system is improved with security and privacy factors. Automated anomaly detection is adapted to the system. Navy bayesian classification technique is integrated to the system. Small query analysis mechanism is integrated with the system.