Method and system for detecting and mitigating denial-of-service attacks

1. A method of detecting a distributed denial of service (DDOS) attack, the method comprising:

obtaining, at an authoritative domain name system (DNS) server, a plurality of DNS query packets from a plurality of DNS requestors over a communications network;

analyzing, by an electronic processor, a set of the plurality of DNS query packets to determine a count of unique source IP addresses in the plurality of DNS query packets over a predetermined period of time;

in response to the count reaching a predetermined threshold, determining that one or more fields in the set of the plurality of DNS query packets share a common feature, wherein the one or more fields comprise at least one or more of: a DNS data field, a recursion desired field, or a time-to-live field;

maintaining a count of the plurality of DNS query packets;

time sampling the set of the plurality of DNS query packets to generate a subset of the plurality of DNS query packets;

determining, by an electronic processor, that the subset of the plurality of DNS query packets of the set that share the common feature meets a predetermined threshold for a rate of DNS queries;

filtering the plurality of DNS query packets based on the determining to produce a filtered number of DNS query packets; and

providing, by the authoritative DNS server, a DNS response for the plurality of DNS query packets that were filtered.

2. A method of detecting a distributed denial of service (DDOS) attack, the method comprising:

obtaining a plurality of domain name system (DNS) query packets from a plurality of DNS requestors from one or more authoritative DNS servers;

analyzing, by an electronic processor, a set of the plurality of DNS query packets to determine a count of unique source IP addresses in the plurality of DNS query packets over a predetermined period of time;

in response to the count reaching a predetermined threshold, determining that one or more fields in the set of the plurality of DNS query packets share a common feature, wherein the one or more fields comprise at least one or more of: a DNS data field, a recursion desired field, or a time-to-live field;

maintaining a count of the plurality of DNS query packets;

time sampling the set of the plurality of DNS query packets to generate a subset of the plurality of DNS query packets;

determining, by an electronic processor, that the subset of the plurality of DNS query packets of the set that share the common feature meets a predetermined threshold; and

providing a result of the determining to a filtering mechanism of each of the one or more authoritative DNS servers.

3. A system comprising:

one or more processors; and

a memory system comprising one or more non-transitory computer-readable media storing instructions that are executed by at least one of the one or more processors, to cause the one or more processors to perform a method of detecting a distributed denial of service (DDOS) attack, the method comprising:

obtaining a plurality of domain name system (DNS) query packets from a plurality of DNS requestors over a communications network;

analyzing, by the one or more processors, a set of the plurality of DNS query packets to determine a count of unique source IP addresses in the plurality of DNS query packets over a predetermined period of time;

in response to the count reaching a predetermined threshold, determining that one or more fields in the set of the plurality of DNS query packets share a common feature, wherein the one or more fields comprise at least one or more of: a DNS data field, a recursion desired field, or a time-to-live field;

maintaining a count of the plurality of DNS query packets;

time sampling the set of the plurality of DNS query packets to generate a subset of the plurality of DNS query packets;

determining, by the one or more processors, that the subset of the plurality of DNS query packets of the set that share the common feature meets a predetermined threshold for a rate of DNS queries;

filtering the plurality of DNS query packets based on the determining to produce a filtered number of DNS query packets; and

providing a DNS response for the plurality of DNS query packets that were filtered.