Defending the core: a comprehensive analysis of DDoS attacks on DNS infrastructure and proactive defense strategies

Distributed Denial of Service (DDoS) attacks, recognized as paramount cyber threats globally, extensively target core network infrastructure, notably Domain Name Systems (DNS). This paper delves into a thorough analysis of diverse defense methodologies, presenting a substantial protective framework to preemptively combat malicious DDoS attacks on DNS infrastructure. By scrutinizing DNS outage data from authoritative infrastructure owners and examining their countermeasures, encompassing Anycast, upstream filters, and redundant network topologies, the paper serves as a guide for emerging DNS service providers. The aim is to assist in the development of robust defensive mechanisms, ensuring the stability and sustainability of network elements and delivering an enhanced quality of service to customers. The proposed DNS server security framework advocates a layered approach, drawing insights from the analysis of security measures, core network components, and case studies published by authoritative DNS infrastructure owners. Initiating security measures at the enduser level, securing the network terminal (NT) through practices such as secure software usage and firewall implementation establishes an initial defense layer. Progressing through the network hierarchy, safeguarding line terminals (LT) involves measures like access control, intrusion detection systems, and traffic monitoring to address potential DDoS threats. The protection extends to the ISP's core components, typically routers, where robust security measures, including access control lists (ACLs), route filtering, and traffic shaping, are implemented to detect and mitigate DDoS attacks at the core level. A comprehensive defense against DDoS attacks is achieved by implementing a layered security approach spanning from enduser terminals to core network components. Customization and adaptation to specific network environments and vendors are highlighted as essential for optimal DNS server protection. This approach aims to enhance DNS server security, mitigate DDoS risks, and ensure uninterrupted availability of DNS services to end-users. Results and discussions encompass various prevention methods, with a focus on Anycast IP addressing.