【作者】 朱琳；

【导师】 张子蛟；

【作者基本信息】 郑州大学 ， 网络空间安全， 2025， 硕士

【摘要】 域名系统(DNS)作为互联网的核心基础设施,其安全性至关重要。然而,随着DNS攻击技术的不断演进,DNS系统生态在协议设计、系统实现及体系架构层面不断暴露出脆弱性,严重威胁其安全。本文从攻击者视角出发,对现行DNS系统机制的设计逻辑与运行原理进行探索,以期分析其潜在安全风险,并基于此从资源耗尽和服务中断两个方向分别提出一种新的DNS拒绝服务攻击方法,为进一步提升DNS系统安全性提供参考。首先,本文从DNS资源耗尽方向提出一种针对递归解析器的内存资源耗尽攻击方法。该方法利用DNS递归解析器在处理跨域NS委托循环依赖链时的逻辑缺陷,诱导其陷入“无限等待”的死循环,从而显著提高其内存负载。通过结合随机子域名技术绕过DNS缓存机制,以及精心构造的多条跨域NS委托循环依赖链,实现对DNS递归解析器内存资源的放大攻击。实验结果表明,该攻击方法能够以少量恶意查询耗尽DNS递归解析器内存,导致其服务瘫痪。其次,本文从DNS服务中断方向提出一种针对解析器缓存的混合型拒绝服务攻击方法。该方法利用了递归解析器的缓存漏洞,其一是递归解析器不加限制地缓存委托响应中的NS记录,其二是递归解析器盲目信任缺乏验证的胶水记录。通过注入大量恶意记录,实现对目标域名解析服务的中断和递归解析器缓存资源的耗尽。在低速率攻击阶段,恶意记录干扰正常解析流程,导致目标域名服务中断;在高速率攻击阶段,缓存频繁刷新可导致良性域名缓存未命中,增加系统负载。实验结果表明,该攻击方法在攻击复杂度上优于现有单向量DNS DoS攻击,具有更大的威胁性和破坏力。综上所述,本文提出的两种新的DNS DoS攻击方法,不仅为DNS DoS攻击资源耗尽领域和服务中断研究领域存在的问题提供新的解决方案,并尝试揭示DNS系统在协议设计、系统实现及体系架构层面可能存在的潜在安全隐患。本研究为进一步提升DNS系统的安全性和鲁棒性提供了有益的参考,对于保障互联网基础设施的安全稳定运行具有实用价值。更多还原

【Abstract】 As a core infrastructure of the Internet,the security of the Domain Name System(DNS)is paramount.However,with the continuous evolution of DNS attack techniques,vulnerabilities in protocol design,system implementation,and architectural frameworks within the DNS ecosystem have been increasingly exposed,posing significant threats to its security.This study adopts an attacker-centric perspective to explore the design logic and operational principles of the current DNS system,aiming to analyze its inherent security risks.Based on this analysis,we propose two novel DNS denial-of-service(DoS)attack methodologies—resource exhaustion and service disruption—to provide actionable insights for enhancing DNS system security.First,focusing on resource exhaustion,this paper presents a memory exhaustion attack targeting DNS recursive resolvers.By exploiting a logical flaw in resolvers’handling of cross-domain NS delegation cyclic dependency chains,the attack induces resolvers into an "infinite wait" deadlock,drastically increasing their memory load.The methodology combines randomized subdomain techniques to bypass DNS caching mechanisms and meticulously crafted cross-domain NS delegation cyclic dependency chains to amplify memory consumption.Experimental results demonstrate that this attack can exhaust a resolver’s memory resources with minimal malicious queries,leading to service paralysis.Second,addressing service disruption,we propose a hybrid DoS attack targeting resolver caches.This method exploits two critical vulnerabilities:(1)resolvers’unrestricted caching of NS records from delegation responses,and(2)their blind trust in unvalidated glue records.By injecting large volumes of malicious records,the attack disrupts target domain resolution and depletes cache resources.During the low-rate attack phase,malicious records interfere with normal resolution processes,causing service interruptions for target domains.In the high-rate phase,frequent cache flushing triggers benign domain cache misses,escalating system load.Experimental results confirm that this hybrid attack surpasses existing single-vector DNS DoS methods in complexity,exhibiting greater threat potential and destructive impact.In summary,the two novel DNS DoS attack methods proposed in this study not only address unresolved challenges in DNS DoS research—specifically in resource exhaustion and service disruption—but also reveal latent security risks in DNS protocol design,system implementation,and architectural frameworks.This research provides valuable references for improving the security and robustness of DNS systems,offering practical significance for safeguarding the stable operation of critical Internet infrastructure.更多还原