Apparatus and method for identifying a domain name system resource exhaustion attack
View Patent ↗A machine includes a processor and a memory connected to the processor. The memory stores instructions executed by the processor to identify a resource attack in response to spikes in the number of unique subdomains being queried and spikes in the number of timeouts or delayed responses from a specified name server.
1. A machine, comprising:
a processor; and
a memory connected to the processor, the memory storing instructions executed by the processor to identify a domain name system resource exhaustion attack in response to spikes in the number of unique subdomains being queried and spikes in the number of failed responses from a specified name server.
2. The machine of claim 1 wherein the memory storing instructions executed by the processor include instructions to:
preserve a second level domain,
track requests for subdomains of the second level domain,
collect response statistics,
compute a subdomain ratio,
compute a failed request ratio, and
identify the resource attack when the subdomain ratio exceeds a first threshold and the failed request ratio exceeds a second threshold.
3. The machine of claim 2 wherein the memory storing instructions executed by the processor include instructions to apply or invoke counter-measures.
4. The machine of claim 3 wherein the counter-measures include domain access restrictions.
5. The machine of claim 3 wherein the counter-measures include per-domain rate limits for lookup requests.
6. The machine of claim 3 wherein the counter-measures include invoking a Response Policy Zone.
7. The machine of claim 2 wherein the request type is used in determining threshold values.