Kaminsky域名系统缓存投毒防御策略研究  

Research on Defense Strategy of Kaminsky DNS Cache Poisoning

作　　者：许成喜[1] 胡荣贵[1] 施凡[1] 张岩庆[1] 

机构地区：[1]电子工程学院网络系,合肥230037

出　　处：《计算机工程》2013年第1期12-17,共6页Computer Engineering

摘　　要：当前缓存域名系统(DNS)服务器无法抵抗持续的Kaminsky DNS缓存投毒攻击。为此,提出一种基于应答报文检查的防御策略。应用概率学理论分析Kaminsky投毒成功概率与投毒持续时间的内在联系,通过报文检查策略抑制投毒成功概率随时间的积累效应,达到防御持续Kaminsky投毒的目的。利用概率模型检查工具PRISM进行仿真实验,结果证明该策略可以使攻击难度提高3 600倍以上。Current cache Domain Name System（DNS） servers can not resist continuing Kaminsky DNS cache poisoning,so this paper proposes a defense strategy based on response packets checking.Probability theory is used to analyze the internal relation between success probability and continuing time of poisoning,which attests the harmfulness of continuing Kaminsky poisoning.Packet checking suppresses success probability＇s accumulative effect on time on the existing basis so that it can be used to defense continuing Kaminsky poisoning.Simulation experiment is conducted based on probabilistic model checking tool PRISM,whose results prove that the strategy can make poison attack more difficult by over 3 600 times than it is now.

关 键 词：Kaminsky域名系统 DNS缓存投毒 概率分析 报文检查 防御策略 模型检查 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]