Formulating responses for slowing requests from malicious domain name system (DNS) clients

1. A method of delaying computer network clients from sending Domain Name System (DNS) queries, the method comprising:

receiving a DNS query from a client;

consulting at least one of a client record in a client record database that stores information about the client and a flow record in a flow record database that stores information about a flow, wherein the information about the flow includes information about one or more previous DNS queries and/or responses in a flow to which the DNS query is assigned;

formulating a response to the DNS query as a function of the information about the client and/or the information about the flow, wherein the DNS query includes a question, the response is intentionally defective or incomplete, and the response causes the client to be delayed in sending another DNS query as part of an attack;

updating at least one of the client record with information about the client and the flow record with information about the DNS query and the response as formulated;

transmitting the response as formulated to the client;

analyzing observed behavior of the client, including analyzing the client record and/or the flow record and analyzing subsequent DNS queries or lack of DNS queries by the client subsequent to one or more transmitted responses; and

formulating a new response to one of the subsequent DNS queries that is likely to cause the client to continue outputting DNS queries based on the analysis of the observed behavior of the client,

wherein when the analysis reveals that the client does not continue outputting the subsequent DNS queries upon receiving the formulated new response, a field in client record and/or the flow record is set to indicate that future DNS queries from the client are to be dropped without a response.

2. The method of claim 1 , wherein the response is well-formed other than a defect, wherein the defect includes a slight malformation of the response that causes the response to be non-compliant with a protocol specification.

3. The method of claim 2 , wherein the malformation intentionally includes at least one of an invalid combination of flags, an invalid identification (ID) field, a mismatched Query Name (QNAME) in the response, and/or omission of an answer to the DNS query.

4. The method of claim 2 , wherein each malformation is selected and/or applied using a randomizing function.

5. The method of claim 1 , wherein,

the DNS query requests an address for a name,

formulating the response includes intentionally including a new canonical name (CNAME) in the response, and

updating the client record and/or the flow record further uses information about the new CNAME.

6. The method of claim 5 , further comprising:

selecting a canonical name (CNAME) chain depth;

querying the client record for the client that sent the DNS query;

for each subsequent request from a client that is sent a DNS query for a previous CNAME response, responding with another new CNAME for a number of times until exceeding the chain depth; and

incrementing the current chain depth in the client record,

wherein updating the client record and/or the flow record further uses information about the selected chain depth.

7. The method of claim 1 , wherein,

the DNS query requests an address for a name,

the method further comprises selecting a black holed canonical name (CNAME) or a black holed name server, and

formulating the response includes intentionally including the black holed CNAME or an address for the black holed name server in the response.

8. A network monitor for monitoring a network during a distributed denial of service (DDOS) attack, the network monitor comprising:

a memory configured to store instructions;

at least one processing device in communication with the memory, wherein the at least one processing device upon execution of the instructions is configured to:

receive a Domain Name System (DNS) query from a client;

consult at least one of a client record in a client record database that stores information about the client and a flow record in a flow record database that stores information about a flow, wherein the information about the flow includes information about one or more previous DNS queries and or responses in a flow to which the DNS query is assigned;

formulate a response to the DNS query as a function of the information about the client and/or the information about the flow, wherein the DNS query includes a question, the response is intentionally defective or incomplete, and the response causes the client to be delayed in sending another DNS query as part of an attack;

update at least one of the client record with information about the client and the flow record with information about the DNS query and the response as formulated;

transmit the response as formulated to the client;

analyze observed behavior of the client, including analyzing the client record and/or the flow record and analyzing subsequent DNS queries or lack of DNS queries by the client subsequent to one or more transmitted responses; and

formulate a new response to one of the subsequent DNS queries that is likely to cause the client to continue outputting DNS queries based on the analysis of the observed behavior of the client,

wherein when the analysis reveals that the client does not continue outputting the subsequent DNS queries upon receiving the formulated new response, a field in client record and/or the flow record is set to indicate that future DNS queries from the client are to be dropped without a response.

9. The network monitor of claim 8 , wherein the response is well-formed other than a defect, wherein the defect includes a slight malformation of the response that causes the response to be non-compliant with a protocol specification.

10. The network monitor of claim 9 , wherein the malformation intentionally includes at least one of an invalid combination of flags, an invalid identification (ID) field, a mismatched Query Name (QNAME) in the response, and/or omission of an answer to the DNS query.

11. The network monitor of claim 9 , wherein each malformation is selected and/or applied using a randomizing function.

12. The network monitor of claim 8 , wherein the DNS query requests an address for a name and formulating the response includes intentionally including a new canonical name (CNAME) in the response, and updating the client record and/or the flow record further uses information about the the new CNAME.

13. The network monitor of claim 12 , wherein the at least one processing device upon execution of the instructions is further configured to:

select a canonical name (CNAME) chain depth;

query the client record for the client that sent the DNS query;

for each subsequent request from a client that is sent a DNS query for a previous CNAME response, respond with another new CNAME for a number of times until exceeding the chain depth; and

increment the current chain depth in the client record,

wherein updating the client record and/or the flow record further uses information about the selected chain depth.

14. The network monitor of claim 8 , wherein,

the DNS query requests an address for a name,

the at least one processing device upon execution of the instructions is further configured to select a black holed canonical name (CNAME) or a black holed name server, and

formulating the response includes intentionally including the black holed CNAME or an address for the black holed name server in the response.

15. A non-transitory computer readable storage medium and one or more computer programs stored therein, the computer programs comprising instructions, which when executed by a computer system, cause the computer system to:

receive a Domain Name System (DNS) query from a client;

consult at least one of a client record in a client record database that stores information about the client and a flow record in a flow record database that stores information about the flow, wherein the information about a flow includes information about one or more previous DNS queries and or responses in a flow to which the DNS query is assigned;

formulate a response to the DNS query as a function of the information about the client and/or the information about the flow, wherein the DNS query includes a question, the response is intentionally defective or incomplete, and the response causes the client to be delayed in sending another DNS query as part of an attack;

update at least one of the client record with information about the client and the flow record with information about the DNS query and the response as formulated; and

transmit the response as formulated to the client;

analyze observed behavior of the client, including analyzing the client record and/or the flow record and analyzing subsequent DNS queries or lack of DNS queries by the client subsequent to one or more transmitted responses, and

formulate a new response to one of the subsequent DNS queries that is likely to cause the client to continue outputting DNS queries based on the analysis of the observed behavior of the client,

wherein when the analysis reveals that the client does not continue outputting the subsequent DNS queries upon receiving the formulated new response, a field in client record and/or the flow record is set to indicate that future DNS queries from the client are to be dropped without a response.

16. The non-transitory computer readable storage medium of claim 15 , wherein the response is well-formed other than a defect, wherein the defect includes a slight malformation of the response that causes the response to be non-compliant with a protocol specification.