CICI: RSARC: DDoS Defense In Depth for DNS

分布式拒绝服务(DDoS)攻击继续困扰着互联网。攻击对社交媒体、内容和许多其他互联网服务产生了重大影响。恶意攻击者正变得越来越老练，他们正在使用各种方法来隐藏他们的攻击来源，放大他们的攻击规模，并使用巨大的僵尸网络来简单地淹没他们的目标。该项目通过开发和部署深度防御方法(称为深层)来直接应对这些高级攻击，以缓解最近出现的DDoS攻击类型。深层将被部署来保护B-Root这一关键基础设施，它是互联网顶级(根)域名系统(DNS)服务的13个提供商之一，以www.DDoS攻击的深层解决方案集成了两种过滤欺骗流量的方法，两种识别已知良好流量的方法(跳数过滤和已知良好客户端的优先排序)，并增加了一个基于云的扩展组件来处理最大的攻击。这些步骤的组合解决了一系列日益复杂的攻击，从今天看到的攻击到未来可能发生的攻击，显著提高了DNS对DDoS攻击的恢复能力。该项目集成和扩展了最近几种成功的DDoS防御研究方法，并展示了它们在B-Root关键基础设施上的有效性。该项目演示了B-Root DNS服务器上的深层，并将其作为开源软件提供给其他DNS操作。这项工作极大地提高了域名系统关键基础设施的可靠性，使所有互联网用户受益。

Distributed Denial-of-Service (DDoS) attacks continue to plague the Internet. Attacks have significant effects on social media, content and many other Internet services. Malicious actors are becoming increasingly sophisticated and are employing methods to hide their attack origins, amplify the size of their attacks, and use huge botnets that simply overwhelm their targets. This project directly addresses these advanced attacks by developing and deploying a defense in depth approach, called Deep Layers, to mitigate the types of DDoS attacks seen most recently. Deep Layers will be deployed to protect B-Root, the critical infrastructure that is one of thirteen providers of the Domain Name System (DNS) service for the top level (root) of Internet names that begin with www.The Deep Layers solution to DDoS attacks integrates two approaches to filter spoofed traffic, two approaches to identify known-good traffic (hop-count filtering and prioritization of known-good clients), with the addition of a cloud-based scaling component to handle the largest attacks. The combination of these steps address an array of increasingly sophisticated attacks, ranging from those seen today to those that would be possible in the future, significantly increasing DNS resilience to DDoS attacks. The project integrates and extends several recent successful research approaches to DDoS defense and demonstrates their effectiveness on the B-root critical infrastructure. The project demonstrates Deep layers on the B-Root DNS server, and makes it available to other DNS operations as open source software. The work vastly improves the reliability of the DNS critical infrastructure, benefiting all Internet users.