Applianced domain name server
A software installation package for a domain name server (DNS) comprises a hardened operating system, a domain name server software, a management interface. To detect and block attack attempts ( 2 - 1 ), the software installation package also comprises an attack detection logic (ADS) for analyzing ( 2 - 2, 2 - 3 ) IP packets based on a set of attack detection rules. A response logic reacts ( 2 - 4 ) to detected attack attempts.
1. A method for making an applianced domain name server, the method comprising:
forming a software installation package for the domain name server; and
making the appplianced domain name server by installing the software installation package in a server, wherein the software installation package comprises:
a hardened operating system;
a securely pre-configured domain name server software;
a management interface;
a local response logic for responding to attack attempts from one or more blacklisted client computers;
a local attack detection logic, wherein the attack detection logic performs one or more analyses, each of which being based on a plurality of IP packets from an individual client computer, based on a predetermined set of attack detection rules,
wherein, if at least some of the analyses, which are based on the plurality of IP packets from the individual client computer, identify the individual client computer as an attacking client computer, the local attack detection logic blacklists the individual client computer as an attacking client computer thereby indicating that IP traffic from the individual client computer should be blocked.
2. The method of claim 1 , wherein Domain Name Service is the only service provided to client computers by the applianced domain name server.
3. A software installation package for a domain name server, the software installation package comprising:
a hardened operating system;
a securely pre-configured domain name server software;
a management interface;
a local attack detection logic, wherein the attack detection logic performs one or more analyses, each of which being based on a plurality of IP packets from an individual client computer, based on a predetermined set of attack detection rules,
wherein, if at least some of the analyses, which are based on the plurality of IP packets from the individual client computer, identify the individual client computer as an attacking client computer, the local attack detection logic blacklists the individual client computer as an attacking client computer thereby indicating that IP traffic from the individual client computer should be blocked, and
wherein the software installation package is stored in a tangible software carrier that constitutes a non-transitory storage medium.
4. The software installation package of claim 3 , wherein the attack detection logic comprises means for monitoring a frequency of inquiries from each of a plurality of client computers.
5. The software installation package of claim 4 , wherein the set of attack detection rules comprises a rule for detecting an attack attempt from a client computer if the monitored frequency of inquiries from that client computer exceeds a predetermined limit.
6. The software installation package of claim 3 , wherein the set of attack detection rules comprises a rule for detecting an attack attempt from a client computer if a monitored size of inquiries from that client computer exceeds a predetermined limit.
7. The software installation package of claim 3 , wherein the response logic comprises means for temporarily suspending the functionality of the domain name server.
8. The software installation package of claim 3 , further comprising an automated process for updating software used in the software installation package after installation and hardening.
9. The software installation package of claim 3 , wherein Domain Name Service is the only service provided to client computers by the applianced domain name server.