Defense against DNS DoS attack
A method for defending a computer system comprising a DNS server against a DoS or a DDoS attack directed at said DNS server comprises replacing the address of said system provided by a user to a client software with an alternative address, wherein said address is replaced by a software agent associated with said user, such that said client software is capable of connecting with said system.
1. A method for defending a computer system comprising a DNS server against a DoS or a DDoS attack directed at said DNS server, comprising:
a) identifying said attack by a configuration server, which monitors the DNS server by detecting consecutive failures for DNS resolution of a hostname/domain requested by a client software that is located on a user's terminal and used to communicate with said system;
b) polling said configuration server by a software agent located on the user's terminal, to detect said attack;
c) if an attack is detected, activating by said software agent an alternative address resolution for said hostname/domain;
d) replacing the address of said system provided by a user to said client software with said alternative address resolution; and
e) connecting said client software with said system via said alternative address resolution.
2. A method according to claim 1 , wherein the software agent is integral with the client software or web browser used by the user.
3. A method according to claim 1 , wherein the software agent is a separate software that interacts with a browser or other client software.
4. A method according to claim 1 , wherein the alternative address is the address of an alternative DNS server.
5. A method according to claim 1 , wherein the alternative address is a static IP address of a resource that must be reached by a user's client software.
6. A system for defending against DoS and DDoS attacks, comprising:
a) a configuration server for identifying said attacks by monitoring a DNS server and detecting consecutive failures for DNS resolution of a hostname/domain requested by a client software located on a user's terminal and used to communicate with said hostname/domain; and
b) a user's terminal having a software agent located thereon, said software agent is adapted to:
b.1) poll said configuration server to detect said attack and if said attack is detected, activate an alternative address resolution for said hostname/domain;
b.2) replace an address of said system provided by a user to said client software with said alternative address resolution; and
b.3) connect said client software with said hostname/domain via said alternative address resolution.