Mitigation method for random subdomain attacks to authoritative DNS servers by traffic control

DDoS(Distributed Denial of Services) attack has been one of the most critical cybersecurity threats on the Internet. DDoS attacks send a lot of requests to specific servers, such as DNS (Domain Name System), SMTP (Simple Mail Transfer Protocol), Web servers, and so on. Eventually these target servers will be forced to stop their services due to the significant high load caused by the DDoS attacks. Random subdomain attack is one of the DDoS attacks, which aims at the authoritative DNS servers.A huge amount of DNS queries for randomly generated subdomain names will be sent to the target authoritative DNS server via a lot of DNS full-service resolvers in a short time period. Consequently, the process of handling non-existent subdomain names will cause a rapid increase in the resource usage of the authoritative server, such as CPU and memory. Thus, when random subdomain attacks occurred on an authoritative server, the Internet users cannot use the Internet services appropriately.In this paper, we propose a mitigation method for the random subdomain attacks by rate limit and traffic control. The proposed method can mitigate the significant increase in the workload and help the authoritative DNS server keep the name resolution service for the legitimate users. We constructed a local network environment and evaluated the proposed method. The results confirmed that the proposed method could mitigate approximately 3.5 times CPU load under pseudo-random subdomain attacks.