SDN-based Detection and Mitigation System for DNS Amplification Attacks

Kaan Ozdincer; Haci Ali Mantar

doi:10.1109/ISMSIT.2019.8932809

SDN-based Detection and Mitigation System for DNS Amplification Attacks

Kaan Ozdincer, Haci Ali Mantar

Gebze Technical University

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

9 Citations (Scopus)

Abstract

DNS amplification is a type of reflection-based DDoS attacks, and they are very hazardous for the reliability of victims within the network. To prevent or mitigate such attacks, a significant amount of work is being done both on conventional networks and on SDN-based networks. This study aimed to detect and reduce the effects of DNS amplification attacks in SDN-based with the developed system. This system aims to monitor the variations in the amplification factor and TTL header to initiate mitigation and sustain the victim's life. It also ensures that legitimate packets are not suspected in the process. In doing so, it is aimed to generate alarms and mitigation by using the central management feature of SDN, by writing the metrics into a time series database immediately. Experimental results show that this system can be used SDN-based networks and prevent an attack in reactively. It has also been observed that it can be used not only for DNS amplification attacks but also for other UDP-based amplification/reflection attacks.

Original language	English
Title of host publication	3rd International Symposium on Multidisciplinary Studies and Innovative Technologies, ISMSIT 2019 - Proceedings
Publisher	Institute of Electrical and Electronics Engineers Inc.
ISBN (Electronic)	9781728137896
DOIs	https://doi.org/10.1109/ISMSIT.2019.8932809
Publication status	Published - Oct 2019
Externally published	Yes
Event	3rd International Symposium on Multidisciplinary Studies and Innovative Technologies, ISMSIT 2019 - Ankara, Turkey Duration: 11 Oct 2019 → 13 Oct 2019

Publication series

Name	3rd International Symposium on Multidisciplinary Studies and Innovative Technologies, ISMSIT 2019 - Proceedings

Conference

Conference	3rd International Symposium on Multidisciplinary Studies and Innovative Technologies, ISMSIT 2019
Country/Territory	Turkey
City	Ankara
Period	11/10/19 → 13/10/19

Bibliographical note

Publisher Copyright:
© 2019 IEEE.

Keywords

Amplifi-cation Factor
DDoS
DNS Amplification
SDN
TTL

Access to Document

10.1109/ISMSIT.2019.8932809

Cite this

Ozdincer, K., & Mantar, H. A. (2019). SDN-based Detection and Mitigation System for DNS Amplification Attacks. In 3rd International Symposium on Multidisciplinary Studies and Innovative Technologies, ISMSIT 2019 - Proceedings Article 8932809 (3rd International Symposium on Multidisciplinary Studies and Innovative Technologies, ISMSIT 2019 - Proceedings). Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/ISMSIT.2019.8932809

Ozdincer, Kaan ; Mantar, Haci Ali. / SDN-based Detection and Mitigation System for DNS Amplification Attacks. 3rd International Symposium on Multidisciplinary Studies and Innovative Technologies, ISMSIT 2019 - Proceedings. Institute of Electrical and Electronics Engineers Inc., 2019. (3rd International Symposium on Multidisciplinary Studies and Innovative Technologies, ISMSIT 2019 - Proceedings).

@inproceedings{4c150427a4cf4e0dbc79f9cfe8a4d6a0,

title = "SDN-based Detection and Mitigation System for DNS Amplification Attacks",

abstract = "DNS amplification is a type of reflection-based DDoS attacks, and they are very hazardous for the reliability of victims within the network. To prevent or mitigate such attacks, a significant amount of work is being done both on conventional networks and on SDN-based networks. This study aimed to detect and reduce the effects of DNS amplification attacks in SDN-based with the developed system. This system aims to monitor the variations in the amplification factor and TTL header to initiate mitigation and sustain the victim's life. It also ensures that legitimate packets are not suspected in the process. In doing so, it is aimed to generate alarms and mitigation by using the central management feature of SDN, by writing the metrics into a time series database immediately. Experimental results show that this system can be used SDN-based networks and prevent an attack in reactively. It has also been observed that it can be used not only for DNS amplification attacks but also for other UDP-based amplification/reflection attacks.",

keywords = "Amplifi-cation Factor, DDoS, DNS Amplification, SDN, TTL",

author = "Kaan Ozdincer and Mantar, {Haci Ali}",

note = "Publisher Copyright: {\textcopyright} 2019 IEEE.; 3rd International Symposium on Multidisciplinary Studies and Innovative Technologies, ISMSIT 2019 ; Conference date: 11-10-2019 Through 13-10-2019",

year = "2019",

month = oct,

doi = "10.1109/ISMSIT.2019.8932809",

language = "English",

series = "3rd International Symposium on Multidisciplinary Studies and Innovative Technologies, ISMSIT 2019 - Proceedings",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

booktitle = "3rd International Symposium on Multidisciplinary Studies and Innovative Technologies, ISMSIT 2019 - Proceedings",

address = "United States",

}

Ozdincer, K & Mantar, HA 2019, SDN-based Detection and Mitigation System for DNS Amplification Attacks. in 3rd International Symposium on Multidisciplinary Studies and Innovative Technologies, ISMSIT 2019 - Proceedings., 8932809, 3rd International Symposium on Multidisciplinary Studies and Innovative Technologies, ISMSIT 2019 - Proceedings, Institute of Electrical and Electronics Engineers Inc., 3rd International Symposium on Multidisciplinary Studies and Innovative Technologies, ISMSIT 2019, Ankara, Turkey, 11/10/19. https://doi.org/10.1109/ISMSIT.2019.8932809

SDN-based Detection and Mitigation System for DNS Amplification Attacks. / Ozdincer, Kaan; Mantar, Haci Ali.
3rd International Symposium on Multidisciplinary Studies and Innovative Technologies, ISMSIT 2019 - Proceedings. Institute of Electrical and Electronics Engineers Inc., 2019. 8932809 (3rd International Symposium on Multidisciplinary Studies and Innovative Technologies, ISMSIT 2019 - Proceedings).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - SDN-based Detection and Mitigation System for DNS Amplification Attacks

AU - Ozdincer, Kaan

AU - Mantar, Haci Ali

PY - 2019/10

Y1 - 2019/10

N2 - DNS amplification is a type of reflection-based DDoS attacks, and they are very hazardous for the reliability of victims within the network. To prevent or mitigate such attacks, a significant amount of work is being done both on conventional networks and on SDN-based networks. This study aimed to detect and reduce the effects of DNS amplification attacks in SDN-based with the developed system. This system aims to monitor the variations in the amplification factor and TTL header to initiate mitigation and sustain the victim's life. It also ensures that legitimate packets are not suspected in the process. In doing so, it is aimed to generate alarms and mitigation by using the central management feature of SDN, by writing the metrics into a time series database immediately. Experimental results show that this system can be used SDN-based networks and prevent an attack in reactively. It has also been observed that it can be used not only for DNS amplification attacks but also for other UDP-based amplification/reflection attacks.

AB - DNS amplification is a type of reflection-based DDoS attacks, and they are very hazardous for the reliability of victims within the network. To prevent or mitigate such attacks, a significant amount of work is being done both on conventional networks and on SDN-based networks. This study aimed to detect and reduce the effects of DNS amplification attacks in SDN-based with the developed system. This system aims to monitor the variations in the amplification factor and TTL header to initiate mitigation and sustain the victim's life. It also ensures that legitimate packets are not suspected in the process. In doing so, it is aimed to generate alarms and mitigation by using the central management feature of SDN, by writing the metrics into a time series database immediately. Experimental results show that this system can be used SDN-based networks and prevent an attack in reactively. It has also been observed that it can be used not only for DNS amplification attacks but also for other UDP-based amplification/reflection attacks.

KW - Amplifi-cation Factor

KW - DDoS

KW - DNS Amplification

KW - SDN

KW - TTL

UR - http://www.scopus.com/inward/record.url?scp=85078049395&partnerID=8YFLogxK

U2 - 10.1109/ISMSIT.2019.8932809

DO - 10.1109/ISMSIT.2019.8932809

M3 - Conference contribution

AN - SCOPUS:85078049395

T3 - 3rd International Symposium on Multidisciplinary Studies and Innovative Technologies, ISMSIT 2019 - Proceedings

BT - 3rd International Symposium on Multidisciplinary Studies and Innovative Technologies, ISMSIT 2019 - Proceedings

PB - Institute of Electrical and Electronics Engineers Inc.

T2 - 3rd International Symposium on Multidisciplinary Studies and Innovative Technologies, ISMSIT 2019

Y2 - 11 October 2019 through 13 October 2019

ER -

Ozdincer K, Mantar HA. SDN-based Detection and Mitigation System for DNS Amplification Attacks. In 3rd International Symposium on Multidisciplinary Studies and Innovative Technologies, ISMSIT 2019 - Proceedings. Institute of Electrical and Electronics Engineers Inc. 2019. 8932809. (3rd International Symposium on Multidisciplinary Studies and Innovative Technologies, ISMSIT 2019 - Proceedings). doi: 10.1109/ISMSIT.2019.8932809

SDN-based Detection and Mitigation System for DNS Amplification Attacks

Abstract

Publication series

Conference

Bibliographical note

Keywords

Access to Document

Other files and links

Fingerprint

Cite this