Domain name system(DNS)amplification distributed denial of service(DDoS)attacks are one of the popular types of intrusions that involve accessing DNS servers on behalf of the victim.In this case,the size of the respon...Domain name system(DNS)amplification distributed denial of service(DDoS)attacks are one of the popular types of intrusions that involve accessing DNS servers on behalf of the victim.In this case,the size of the response is many times greater than the size of the request,in which the source of the request is substituted for the address of the victim.This paper presents an original method for countering DNS amplification DDoS attacks.The novelty of our approach lies in the analysis of outgoing traffic from the victim’s server.DNS servers used for amplification attacks are easily detected in Internet control message protocol(ICMP)packet headers(type 3,code 3)in outgoing traffic.ICMP packets of this type are generated when accessing closed user datagram protocol(UDP)ports of the victim,which are randomly assigned by the Saddam attack tool.To prevent such attacks,we used a Linux utility and a software-defined network(SDN)module that we previously developed to protect against port scanning.The Linux utility showed the highest efficiency of 99.8%,i.e.,only two attack packets out of a thousand reached the victim server.展开更多
跨站脚本XSS(Cross Site Scripting)漏洞,已对大多数网站产生严重威胁。其中存储型XSS漏洞对用户及网站的损害尤为巨大。事先使用漏洞扫描工具对该漏洞进行检测并修补,可以有效预防和减轻该漏洞被利用后导致的一系列危害。分析存储型XS...跨站脚本XSS(Cross Site Scripting)漏洞,已对大多数网站产生严重威胁。其中存储型XSS漏洞对用户及网站的损害尤为巨大。事先使用漏洞扫描工具对该漏洞进行检测并修补,可以有效预防和减轻该漏洞被利用后导致的一系列危害。分析存储型XSS漏洞的攻击原理,提出用巴科斯范式(BNF)自动生成初始攻击向量,对初始攻击向量进行变异处理。使用辅助标记自动检测存储型XSS漏洞的动态检测方法,设计并实现存储型XSS漏洞检测系统。在现实Web应用中测试评估了该系统,实验证明它能有效检测出应用中存在的存储型XSS漏洞。展开更多
基金Russian Foundation for Basic Research(RFBR)(20-37-90002)Andrei Sukhov acknowledge SevSU for a Research(42-01-09/253/2022-1)。
文摘Domain name system(DNS)amplification distributed denial of service(DDoS)attacks are one of the popular types of intrusions that involve accessing DNS servers on behalf of the victim.In this case,the size of the response is many times greater than the size of the request,in which the source of the request is substituted for the address of the victim.This paper presents an original method for countering DNS amplification DDoS attacks.The novelty of our approach lies in the analysis of outgoing traffic from the victim’s server.DNS servers used for amplification attacks are easily detected in Internet control message protocol(ICMP)packet headers(type 3,code 3)in outgoing traffic.ICMP packets of this type are generated when accessing closed user datagram protocol(UDP)ports of the victim,which are randomly assigned by the Saddam attack tool.To prevent such attacks,we used a Linux utility and a software-defined network(SDN)module that we previously developed to protect against port scanning.The Linux utility showed the highest efficiency of 99.8%,i.e.,only two attack packets out of a thousand reached the victim server.
文摘跨站脚本XSS(Cross Site Scripting)漏洞,已对大多数网站产生严重威胁。其中存储型XSS漏洞对用户及网站的损害尤为巨大。事先使用漏洞扫描工具对该漏洞进行检测并修补,可以有效预防和减轻该漏洞被利用后导致的一系列危害。分析存储型XSS漏洞的攻击原理,提出用巴科斯范式(BNF)自动生成初始攻击向量,对初始攻击向量进行变异处理。使用辅助标记自动检测存储型XSS漏洞的动态检测方法,设计并实现存储型XSS漏洞检测系统。在现实Web应用中测试评估了该系统,实验证明它能有效检测出应用中存在的存储型XSS漏洞。
