A Large Scale Analysis of DNS Water Torture Attack

Random domains are widely used in present network environment. In the benign services, they have been utilized as disposable domains to transfer one-time signals. However, in recent, based on the convenience of random domains, some cybercriminals have utilized them to launch DNS water torture attack, a kind of DDoS attack targeting on the authoritative servers. Most of the Researchers dedicate in analyzing the random domains used for DGA (Domain Generation Algorithm) malware C&C communication rather than the DNS water torture attack. In order to get more facts about the nature of this kind of attacks, we compare behaviors of the DNS water torture attack with the DGA malware and disposable service from three aspects, i.e., time pattern, lexical property and the participants (clients and victims). Based on a month of real-world DNS traffic, we find that, first, the volume of the DNS water torture attack is significantly larger than the volume of disposable domains and DGA queries. Second, the character distribution of domains generated in the DNS water torture attacks are more random than disposable domains and DGA domains. Third, the client IP launching the DNS water torture attack are all random generated fake addresses. Fourth, the victims are themselves lawbreaker, e.g., pornographic website and gambling website. At last, we give some advices based on the analysis result to mitigate the DNS water torture attack.