Automatic Detection and Rectification of DNS Reflection Amplification Attacks with Hadoop MapReduce and Chukwa

摘要

DNS Reflection Amplification Attacks are now a days popular and it is the Distributed Denial of Service Attack. This attack makes use of DNS Servers, which are publicly hosted and accessible by everyone, to give huge responses to victims. The victims thus get overloaded by the huge responses for which they do not have sent requests, thus exhausting the resources of the victim. Chukwa is a hadoop subproject which is designed for distributed log monitoring and analysis. This paper concentrates on detecting the DNS Reflection Amplification Attacks by using chukwa for log collection and HDFS for storing logs and Chukwa Demux jobs which are Map Reduce Jobs for detecting the orphan queries and thus automatically defensing by updating the firewall rules.