臺灣博碩士論文加值系統

DNS為Internet服務中最不可或缺的基礎建設之一。連接上Internet都需要DNS的幫助來完成網域名稱(Domain name)與IP位址(IP address)之間的轉換。過去在網路尚未普及的年代，DNS的安全並未為人們所重視。現今大家對Internet的需求越來越大，DNS也逐漸成為駭客攻擊的目標。
近來Internet上的DNS放大攻擊(DNS amplification attacks)事件急遽增加，因為DNS協定有其設計上的缺失再加上DNS查詢/回覆封包大小的不對稱性。因此DNS容易遭到駭客利用來進行分散式阻斷服務(Distributed Denial of Service ,DDoS)攻擊。然而多數使用者未必知悉其DNS伺服器遭利用成為網路攻擊事件中的幫兇。本研究將以臺北市立大學為例，概述DNS沿革與架構，並探討發生DNS放大DDoS攻擊的原因。依據這些原因，擬訂相關預防措施以強化DNS伺服器的安全性且避免成為DNS放大DDoS攻擊的幫兇。經過實作後證實所擬定的預防措施都是可行、有效的。

DNS is the one of most indispensable infrastructures of Internet service. Any resource connected to the Internet, DNS translate its domain name into IP address. Before the Internet was not yet universal, DNS security was not an important topic at network research. At present people are growing needs for Internet service, DNSs become that hackers attack targets.
Recently DNS amplification attacks events of Internet increase rapidly, because DNS protocol has design flaws and the asymmetry in size between DNS queries and replies. Therefore, DNS exists much vulnerability. Hackers can use the distributed Denial of Service attack to destroy DNS services. However, most people were not aware that their DNS servers become accomplices on Internet attacks. In this thesis, we will study an overview of DNS evolution and architecture, and explore the reasons of DNS amplification DDoS attacks. The research sample focuses on University of Taipei. According to these reasons, we propose some related precautions to strengthen the security of our DNS servers and avoid that our DNS servers become accomplices of DNS amplification DDoS attacks. After the implementations by our precautions, our methods are effective.

第一章 緒論 1
第一節 研究背景 1
第二節 研究動機與目的 3
第三節 研究方法 5
第四節 論文架構 5
第二章 文獻探討 6
第一節 Internet簡介 6
第二節 DNS起源 7
第三節 DNS架構 12
第四節 DNS查詢流程 18
第五節 DNS訊息封包格式 23
第六節 DDoS攻擊 31
第三章 DNS放大DDoS攻擊分析與防範措施 37
第一節 DNS放大DDoS攻擊原理 37
第二節 臺北市立大學DNS環境介紹 41
第三節 DNS防範策略 43
第四章 攻擊分析與防範實作 47
第一節 由外部網路發起的攻擊分析與防範 47
第二節 由內部網路發起的攻擊分析與防範 53
第五章 結論與未來方向 57
參考文獻 58

[1] Anagnostopoulos, M., Kambourakis, G., Kopanos, P., Louloudakis, G., Gritzalis, S., DNS amplification attack revisited, Computers & Security 39, 475–485 (2013).
[2] Arends, R., Austein, R., Larson, M., Massey, D., Rose, S., DNS Security Introduction and Requirements, RFC 4033, March (2005).
[3] Arends, R., Austein, R., Larson, M., Massey, D., Rose, S., Protocol Modifications
for the DNS Security Extensions, RFC 4035, March (2005).
[4] Arends, R., Austein, R., Larson, M., Massey, D., Rose, S., Resource Records for
the DNS Security Extensions, RFC 4034, March (2005).
[5] Beitollahi, H., Deconinck, G., Analyzing well-known countermeasures against distributed denial of service attacks, Computer Communications 35, 1312–1332 (2012)
[6] Carl, G., Kesidis, G., Denial-of-service attack detection techniques, Journal IEEE
Internet Computing 10, 82–89 (2006).
[7] Garber, L., Denial-of-service attacks rip the internet, IEEE Computer 33, 12–17 (2000).
[8] Guo, F., Chen, J., Chiueh, T., Spoof detection for preventing doS attacks against DNS servers, In Proceedings of the 26th IEEE International Conference on Distributed Compiting Systems, pp. 37 (2006).
[9] Ioannidis, J., Bellovin, S.M., Implementing pushback: router-based defense against DDoS attacks, In Proceedings Internet Society Symposium on Network and Distributed System Security, (2002).
[10] Kambourakis, G., Moschos, T., Geneiatakis. D., Gritzalis, S., A fair solution to DNS amplification attacks, In Proceeding of the Second International Workshop on Digital Forensics and Incident Analysis, 38–47 (2007).
[11] Kambourakis, G., Moschos, T., Geneiatakis, D., Gritzalis, S., Detecting DNS amplification attacks, In Proceedings of the 2nd International Workshop on Critical Information Infrastructures Security, LNCS 5141, pp. 185–196 (2007).
[12] Mockapetris P., Domain Names– Concepts and Facilities, RFC 1034, November(1987).
[13] Mockapetris P., Domain Names– Implementation and Specification, RFC 1035,November (1987).
[14] Vaughn, R., Evron, G., DNS Amplification Attacks, A preliminary release, March (2006).
[15] Vixie P., Extension Mechanisms for DNS, RFC 2671, August (1999).
[16] DNS Distributed Denial of Service (DDoS) Attacks, Security and Stability Advisory Committee (SSAC), ICANN Report, (2006).
[17] https://blog.cloudflare.com/the-ddos-that-knocked-spamhaus-offline-and-ho/
[18] https://en.wikipedia.org/wiki/Domain_Name_System
[19] http://www.cert.org/advisories/CA-1996-26.html
[20] https://www.internetsociety.org/sites/default/files/Global_Internet_Report_2014_0.pdf, Internet Society Global Internet Report 2014, (2014).
[21] http://www.redbarn.org/dns/ratelimits
[22] http://www.icann.org/committees/security/dns-ddos-advisory-31mar06.pdf, SSAC advisory sAC008 DNS distributed denial of service (DDoS) attacks, A Report from the ICANN Security and Stability Advisory Committee.
[23] http://pages.arbornetworks.com/rs/arbor/images/WISR2014.pdf, Worldwide Infrastructure Security Report IX, Arbor networks.
[24] 王啟建,高仲合,基於 DNS攻擊的安全分析及防範, 信息技術與信息化, 第六期, (2006).
[25] 李基, 楊義先,DNS安全問題及解决方案,北京郵電大學信息安全中心, (2005).
[26] 姜春茂,基於DNS攻擊的安全防範策略, 陝西科技大學學報, (2004).
[27] 洪海, 曹志華, 鮑旭華, DDoS分散式阻斷服務攻擊深度解析, 碁峯, (2014).
[28] 鳥哥, 鳥哥的LINUX私房菜伺服器架設篇, 第三版, 基峯, (2011).
[29] 趙連才,DNS攻擊的安全防範策略, 電腦知識與技術, (2004).
[30] 蔣大偉,DNS and BIND管理,第五版, 歐萊禮, (2007).
[31] 謝木政, 陳怡碩, 開放性DNS解析伺服器之防治, TANET2013台灣網際網路研討會 (2013).
[32] 2014年台灣寬頻網路使用調查報告, 台灣網路資訊中心TWNIC, (2014).
[33] DNS 安全檢測之研究,台灣電腦網路危機處理暨協調中心
[34] DNS放大攻擊原理、實現與防禦, 编程愛好者, (2007).
[35] DNS架構及查詢流程, http://blog.faq-book.com/?p=2819.
[36] 史上最大DDoS攻擊流量-DNS反射/放大攻擊分析, 資安人, http://www.informationsecurity.com.tw/article/article_detail.aspx?aid=7737
[37] 國外連線頻寬統計表 http://map.twnic.net.tw/function/ibwhreport.php
[38] 您已經完全準備好對抗DNS 攻擊了嗎？,
http://go.infoblox.com/downloads-traditional-chinese/infoblox-whitepaper-prepare-withstand-DNS-attacks-zh-TW.pdf
[39] 維基百科, http://zh.wikipedia.org/wiki/BIND
[40] 維基百科, https://en.wikipedia.org/wiki/Internet_protocol_suite
[41] 維基百科, https://en.wikipedia.org/wiki/Paul_Mockapetris
[42] 維基百科, https://zh.wikipedia.org/wiki/IPv4
[43] 維基百科, https://zh.wikipedia.org/wiki/IPv6
[44] 網際網路(Internet)簡介, http://www.edu.tw/pages/detail.aspx?Node=2796&Page=19615&Index=6&WID=3ee9c9ee-f44e-44f0-A431-c300341d9f77