标题： POPS：从DNS缓存投毒攻击的历史到缓解措施 显示英文标题

标题： POPS: From History to Mitigation of DNS Cache Poisoning Attacks

摘要： 我们提出了一种新颖但简单且全面的DNS缓存投毒预防系统（POPS），设计为入侵防御系统（IPS）中的一个模块。 POPS针对统计学DNS投毒攻击，包括从2002年至今记录的攻击，并提供了对类似未来威胁的稳健保护。 它由两个主要组件组成：一个检测模块，采用三条简单的规则，以及一个缓解模块，利用DNS报头中的TC标志来增强安全性。 一旦激活，缓解模块将没有误报或漏报，纠正检测模块方面的任何错误。 我们首先对POPS进行历史DNS服务和攻击分析，表明它将减轻所有基于网络的统计投毒攻击，使攻击者的成功率为仅0.0076%。 然后我们在包含当前潜在基于网络的统计投毒攻击和良性PCAPs的流量基准上模拟POPS；模拟攻击仍然以0.0076%的概率成功。 这是因为五条恶意数据包在POPS检测到攻击并激活缓解模块之前就通过了。 此外，POPS仅需其他工具（例如Suricata或Snort）所需时间的20%-50%即可完成任务，并且仅检查了5%-10%的数据包数量。 此外，它成功识别了DNS缓存投毒攻击——如分片攻击——而Suricata和Snort都无法检测到，突显了其在提供全面DNS保护方面的优越性。 显示英文摘要

摘要： We present a novel yet simple and comprehensive DNS cache POisoning Prevention System (POPS), designed to integrate as a module in Intrusion Prevention Systems (IPS). POPS addresses statistical DNS poisoning attacks, including those documented from 2002 to the present, and offers robust protection against similar future threats. It consists of two main components: a detection module that employs three simple rules, and a mitigation module that leverages the TC flag in the DNS header to enhance security. Once activated, the mitigation module has zero false positives or negatives, correcting any such errors on the side of the detection module. We first analyze POPS against historical DNS services and attacks, showing that it would have mitigated all network-based statistical poisoning attacks, yielding a success rate of only 0.0076% for the adversary. We then simulate POPS on traffic benchmarks (PCAPs) incorporating current potential network-based statistical poisoning attacks, and benign PCAPs; the simulated attacks still succeed with a probability of 0.0076%. This occurs because five malicious packets go through before POPS detects the attack and activates the mitigation module. In addition, POPS completes its task using only 20%-50% of the time required by other tools (e.g., Suricata or Snort), and after examining just 5%-10% as many packets. Furthermore, it successfully identifies DNS cache poisoning attacks-such as fragmentation attacks-that both Suricata and Snort fail to detect, underscoring its superiority in providing comprehensive DNS protection.