{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T02:36:52Z","timestamp":1790822212592,"version":"4.1.0"},"publisher-location":"New York, NY, USA","reference-count":64,"publisher":"ACM","license":[{"start":{"date-parts":[[2021,11,2]],"date-time":"2021-11-02T00:00:00Z","timestamp":1635811200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/501100002347","name":"Bundesministerium f\u00fcr Bildung und Forschung","doi-asserted-by":"publisher","award":["PRIMEnet"],"award-info":[{"award-number":["PRIMEnet"]}],"id":[{"id":"10.13039\/501100002347","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2021,11,2]]},"DOI":"10.1145\/3487552.3487835","type":"proceedings-article","created":{"date-parts":[[2021,11,1]],"date-time":"2021-11-01T17:35:11Z","timestamp":1635788111000},"page":"419-434","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":32,"title":["The far side of DNS amplification"],"prefix":"10.1145","author":[{"given":"Marcin","family":"Nawrocki","sequence":"first","affiliation":[{"name":"Freie Universit\u00e4t Berlin, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Mattijs","family":"Jonker","sequence":"additional","affiliation":[{"name":"University of Twente, Netherlands"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Thomas C.","family":"Schmidt","sequence":"additional","affiliation":[{"name":"HAW Hamburg, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Matthias","family":"W\u00e4hlisch","sequence":"additional","affiliation":[{"name":"Freie Universit\u00e4t Berlin, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2021,11,2]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"crossref","unstructured":"J. Abley O. Gudmundsson M. Majkowski and E. Hunt. 2019. Providing Minimal-Sized Responses to DNS Queries That Have QTYPE=ANY. RFC 8482. IETF.","DOI":"10.17487\/RFC8482"},{"key":"e_1_3_2_1_2_1","volume-title":"NXNSAttack: Recursive DNS Inefficiencies and Vulnerabilities. In 29th USENIX Security Symposium (USENIX Security 20)","author":"Afek Yehuda","year":"2020","unstructured":"Yehuda Afek, Anat Bremler-Barr, and Lior Shafir. 2020. NXNSAttack: Recursive DNS Inefficiencies and Vulnerabilities. In 29th USENIX Security Symposium (USENIX Security 20). USENIX Association, Berkeley, CA, USA, 631--648. https:\/\/www.usenix.org\/conference\/usenixsecurity20\/presentation\/afek"},{"key":"e_1_3_2_1_3_1","volume-title":"NXNSAttack: Recursive DNS Inefficiencies and Vulnerabilities. In 29th USENIX Security Symposium (USENIX Security 20)","author":"Afek Yehuda","year":"2020","unstructured":"Yehuda Afek, Anat Bremler-Barr, and Lior Shafir. 2020. NXNSAttack: Recursive DNS Inefficiencies and Vulnerabilities. In 29th USENIX Security Symposium (USENIX Security 20). USENIX Association, Berkeley, CA, USA, 631--648. https:\/\/www.usenix.org\/conference\/usenixsecurity20\/presentation\/afek"},{"key":"e_1_3_2_1_4_1","volume-title":"Proc. of ACM SIGCOMM. ACM","author":"Ager B.","unstructured":"B. Ager, N. Chatzis, A. Feldmann, N. Sarrar, S. Uhlig, and W. Willinger. 2012. Anatomy of a Large European IXP. In Proc. of ACM SIGCOMM. ACM, New York, NY, USA, 163--174."},{"key":"e_1_3_2_1_5_1","volume-title":"Pro DNS and BIND 10","author":"Aitchison Ron","unstructured":"Ron Aitchison. 2011. Pro DNS and BIND 10. Apress, New York."},{"key":"e_1_3_2_1_6_1","volume-title":"B","author":"Anagnostopoulos Marios","year":"2013","unstructured":"Marios Anagnostopoulos, Georgios Kambourakis, Panagiotis Kopanos, Georgios Louloudakis, and Stefanos Gritzalis. 2013. DNS amplification attack revisited. Computers & Security 39, B (2013), 475--485."},{"key":"e_1_3_2_1_7_1","volume-title":"Proc","author":"Backes Michael","unstructured":"Michael Backes, Thorsten Holz, Christian Rossow, Teemu Rytilahti, Milivoj Simeonovski, and Ben Stock. 2016. On the Feasibility of TTL-Based Filtering for DRDoS Mitigation. In Proc. of RAID. Springer Verlag, Berlin, Heidelberg, N.Y., 303--322."},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/2504730.2504746"},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.5555\/3241189.3241291"},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1145\/2663716.2663717"},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"crossref","unstructured":"J. Damas M. Graff and P. Vixie. 2013. Extension Mechanisms for DNS (EDNS(0)). RFC 6891. IETF.","DOI":"10.17487\/rfc6891"},{"key":"e_1_3_2_1_12_1","volume-title":"Proc. of KDD. AAAI Press","author":"Ester Martin","year":"1996","unstructured":"Martin Ester, Hans-Peter Kriegel, J\u00f6rg Sander, Xiaowei Xu, et al. 1996. A Density-Based Algorithm for Discovering Clusters in Large Spatial Databases with Noise. In Proc. of KDD. AAAI Press, Palo Alto, California, 226--231."},{"key":"e_1_3_2_1_13_1","unstructured":"Jasper Eumann Raphael Hiesgen Thomas C. Schmidt and Matthias W\u00e4hlisch. 2019. A Reproducibility Study of \"IP Spoofing Detection in Inter-Domain Traffic\". Technical Report arXiv:1911.05164. Open Archive: arXiv.org. https:\/\/arxiv.org\/abs\/1911.05164"},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1109\/NTMS.2014.6814019"},{"key":"e_1_3_2_1_15_1","volume-title":"Proc. of IFIP Networking Conference. IEEE Press","author":"Fonseca Osvaldo","year":"2020","unstructured":"Osvaldo Fonseca, \u00cdtalo Cunha, Elverton Fazzion, Wagner Meira, Brivaldo Junior, Ronaldo A. Ferreira, and Ethan Katz-Bassett. 2020. Tracking Down Sources of Spoofed IP Packets. In Proc. of IFIP Networking Conference. IEEE Press, Piscataway, NJ, USA, 208--216."},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"crossref","unstructured":"P. Hoffman and P. McManus. 2018. DNS Queries over HTTPS (DoH). RFC 8484. IETF.","DOI":"10.17487\/RFC8484"},{"key":"e_1_3_2_1_17_1","volume-title":"Proceedings of the IEEE Workshop on Information Assurance and Security. IEEE Press","author":"Holz T.","unstructured":"T. Holz and F. Raynal. 2005. Detecting Honeypots and other suspicious environments. In Proceedings of the IEEE Workshop on Information Assurance and Security. IEEE Press, Piscataway, NJ, USA, 29--36."},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"crossref","unstructured":"Z. Hu L. Zhu J. Heidemann A. Mankin D. Wessels and P. Hoffman. 2016. Specification for DNS over Transport Layer Security (TLS). RFC 7858. IETF.","DOI":"10.17487\/RFC7858"},{"key":"e_1_3_2_1_19_1","unstructured":"Don Jackson. 2009. DNS Amplification Variation Used in Recent DDoS Attacks. Online: https:\/\/www.secureworks.com\/research\/dns-amplification. https:\/\/www.secureworks.com\/research\/dns-amplification"},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/3131365.3131383"},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","unstructured":"Mohammad Karami Youngsam Park and Damon McCoy. 2016. Stress Testing the Booters: Understanding and Undermining the Business of DDoS Services. In Proceedings of the 25th International Conference on World Wide Web (Montr\u00e9al Qu\u00e9bec Canada) (WWW '16). International World Wide Web Conferences Steering Committee Republic and Canton of Geneva CHE 1033--1043. 10.1145\/2872427.2883004","DOI":"10.1145\/2872427.2883004"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"crossref","unstructured":"O. Kolkman W. Mekking and R. Gieben. 2012. DNSSEC Operational Practices Version 2. RFC 6781. IETF.","DOI":"10.17487\/rfc6781"},{"key":"e_1_3_2_1_23_1","volume-title":"Proc","author":"Kopp Daniel","unstructured":"Daniel Kopp, Christoph Dietzel, and Oliver Hohlfeld. 2021. DDoS Never Dies? An IXP Perspective on DDoS Amplification Attacks. In Proc. of PAM. Springer International Publishing, Berlin, Heidelberg, N.Y., 284--301."},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/3355369.3355590"},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/3404868.3406668"},{"key":"e_1_3_2_1_26_1","volume-title":"Proc","author":"Kr\u00e4mer Lukas","unstructured":"Lukas Kr\u00e4mer, Johannes Krupp, Daisuke Makita, Tomomi Nishizoe, Takashi Koide, Katsunari Yoshioka, and Christian Rossow. 2015. AmpPot: Monitoring and Defending Against Amplification DDoS Attacks. In Proc. of RAID. Springer Verlag, Berlin, Heidelberg, N.Y., 615--636."},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978293"},{"key":"e_1_3_2_1_28_1","volume-title":"Proc","author":"Krupp Johannes","unstructured":"Johannes Krupp, Mohammad Karami, Christian Rossow, Damon McCoy, and Michael Backes. 2017. Linking amplification DDoS attacks to booter services. In Proc. of RAID. Springer Verlag, Berlin, Heidelberg, N.Y., 427--449."},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1145\/2815675.2815683"},{"key":"e_1_3_2_1_30_1","volume-title":"Proc. of USENIX Security. USENIX Association","author":"K\u00fchrer Marc","year":"2014","unstructured":"Marc K\u00fchrer, Thomas Hupperich, Christian Rossow, and Thorsten Holz. 2014. Exit from Hell? Reducing the Impact of Amplification DDoS Attacks. In Proc. of USENIX Security. USENIX Association, Berkeley, CA, USA, 111--125."},{"key":"e_1_3_2_1_31_1","volume-title":"Proc. of USENIX WOOT. USENIX Association","author":"K\u00fchrer Marc","year":"2014","unstructured":"Marc K\u00fchrer, Thomas Hupperich, Christian Rossow, and Thorsten Holz. 2014. Hell of a Handshake: Abusing TCP for Reflective Amplification DDoS Attacks. In Proc. of USENIX WOOT. USENIX Association, Berkeley, CA, USA, 6 pages."},{"key":"e_1_3_2_1_32_1","unstructured":"Craig Labovitz. 2021. Tracing Volumetric DDoS to its Booter \/ IPHM Origins. NANOG 82 Virtual. https:\/\/storage.googleapis.com\/site-media-prod\/meetings\/NANOG82Virtual\/2368\/20210611_Labovitz_Tracing_Ddos_End-To-End_v1.pdf"},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1145\/3131365.3131367"},{"key":"e_1_3_2_1_34_1","first-page":"2579","article-title":"Visualizing data using t-SNE","author":"van der Maaten Laurens","year":"2008","unstructured":"Laurens van der Maaten and Geoffrey Hinton. 2008. Visualizing data using t-SNE. Journal of Machine Learning Research 9, Nov (2008), 2579--2605.","journal-title":"Journal of Machine Learning Research 9"},{"key":"e_1_3_2_1_35_1","volume-title":"Characterizing Optimal DNS Amplification Attacks and Effective Mitigation. In International Conference on Passive and Active Network Measurement. Springer Verlag","author":"MacFarland Douglas C","year":"2015","unstructured":"Douglas C MacFarland, Craig A Shue, and Andrew J Kalafut. 2015. Characterizing Optimal DNS Amplification Attacks and Effective Mitigation. In International Conference on Passive and Active Network Measurement. Springer Verlag, Berlin, Heidelberg, N.Y., 15--27."},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1145\/2980258.2980431"},{"key":"e_1_3_2_1_37_1","volume-title":"30th USENIX Security Symposium (USENIX Security 21)","author":"Moon Soo-Jin","year":"2021","unstructured":"Soo-Jin Moon, Yucheng Yin, Rahul Anand Sharma, Yifei Yuan, Jonathan M Spring, and Vyas Sekar. 2021. Accurately Measuring Global Risk of Amplification Attacks using AmpMap. In 30th USENIX Security Symposium (USENIX Security 21). USENIX Association, Berkeley, CA, USA, 18 pages. https:\/\/www.usenix.org\/conference\/usenixsecurity21\/presentation\/moon"},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1145\/3355369.3355568"},{"key":"e_1_3_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1109\/IAW.2007.381919"},{"key":"e_1_3_2_1_40_1","volume-title":"Proc. of ACM CoNEXT. ACM","author":"M\u00fcller Lucas F.","unstructured":"Lucas F. M\u00fcller, Matthew J. Luckie, Bradley Huffaker, kc claffy, and Marinho P. Barcellos. 2019. Challenges in Inferring Spoofed Traffic at IXPs. In Proc. of ACM CoNEXT. ACM, New York, NY, USA, 96--109."},{"key":"e_1_3_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1145\/3355369.3355593"},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1145\/3485983.3494872"},{"key":"e_1_3_2_1_43_1","unstructured":"Marcin Nawrocki Matthias W\u00e4hlisch Thomas C. Schmidt Christian Keil and Jochen Sch\u00f6nfelder. 2016. A Survey on Honeypot Software and Data Analysis. Technical Report arXiv:1608.06249. Open Archive: arXiv.org. http:\/\/arxiv.org\/abs\/1608.06249"},{"key":"e_1_3_2_1_44_1","unstructured":"RIPE NCC. [n.d.]. RIPE Routing Information Service (RIS). Online: http:\/\/www.ripe.net\/projects\/ris\/rawdata.html. https:\/\/www.ripe.net\/projects\/ris\/rawdata.html"},{"key":"e_1_3_2_1_45_1","unstructured":"NETSCOUT. 2019. Cloud in the Crosshairs. 14th Annual Worldwide Infrastructure Security Report. Online: https:\/\/www.netscout.com\/sites\/default\/files\/2019-03\/SECR_005_EN-1901\\T1\\textendashWISR.pdf. https:\/\/www.netscout.com\/sites\/default\/files\/2019-03\/SECR_005_EN-1901\\T1\\textendashWISR.pdf"},{"key":"e_1_3_2_1_46_1","volume-title":"Daisuke Makita, Katsunari Yoshioka, and Michel Van Eeten.","author":"Noroozian Arman","year":"2016","unstructured":"Arman Noroozian, Maciej Korczy\u0144ski, Carlos Hernandez Ga\u00f1an, Daisuke Makita, Katsunari Yoshioka, and Michel Van Eeten. 2016. Who Gets the Boot? Analyzing Victimization by DDoS-as-a-Service. In Proc. of RAID. Springer Verlag, Berlin, Heidelberg, N.Y., 368--389."},{"key":"e_1_3_2_1_47_1","volume-title":"DDoS Attacks in Q4","author":"Oleg Kupreev Alexander Gutnikov","year":"2018","unstructured":"Alexander Gutnikov Oleg Kupreev, Ekaterina Badovskaya. 2019. DDoS Attacks in Q4 2018. Kaspersky Labs, Online: https:\/\/securelist.com\/ddos-attacks-in-q4-2018\/89565\/. https:\/\/securelist.com\/ddos-attacks-in-q4-2018\/89565\/"},{"key":"e_1_3_2_1_48_1","volume-title":"Thomas C. Schmidt, and Matthias W\u00e4hlisch.","author":"Osterweil Eric","year":"2021","unstructured":"Eric Osterweil, Pouyan Fotouhi Tehrani, Thomas C. Schmidt, and Matthias W\u00e4hlisch. 2021. From the Beginning: Key Transitions in the First 15 Years of DNSSEC. Technical Report arXiv:2109.08783. Open Archive: arXiv.org. https:\/\/arxiv.org\/abs\/2109.08783"},{"key":"e_1_3_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2019.00057"},{"key":"e_1_3_2_1_50_1","volume-title":"From Botnet Tracking to Intrusion Detection","author":"Provos Niels","unstructured":"Niels Provos and Thorsten Holz. 2008. Virtual Honeypots. From Botnet Tracking to Intrusion Detection (2nd ed.). Addison-Wesley, Upper Saddle River, NJ.","edition":"2"},{"key":"e_1_3_2_1_51_1","doi-asserted-by":"publisher","DOI":"10.1145\/3419394.3423640"},{"key":"e_1_3_2_1_52_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2014.23233"},{"key":"e_1_3_2_1_53_1","unstructured":"Russian Embassy UK. 2019. Cyberattacks on the Russian Embassy website. Twitter. https:\/\/twitter.com\/russianembassy\/status\/1163803718342475776"},{"key":"e_1_3_2_1_54_1","volume-title":"Schmidt","author":"Ryba Fabrice J.","year":"2015","unstructured":"Fabrice J. Ryba, Matthew Orlinski, Matthias W\u00e4hlisch, Christian Rossow, and Thomas C. Schmidt. 2015. Amplification and DRDoS Attack Defense - A Survey and New Perspectives. Technical Report arXiv:1505.07892. Open Archive: arXiv.org. http:\/\/arxiv.org\/abs\/1505.07892"},{"key":"e_1_3_2_1_55_1","doi-asserted-by":"publisher","DOI":"10.1109\/INM.2015.7140298"},{"key":"e_1_3_2_1_56_1","doi-asserted-by":"publisher","DOI":"10.1145\/2504730.2504734"},{"key":"e_1_3_2_1_57_1","unstructured":"Shodan. [n.d.]. Shodan - the world's first search engine for Internet-connected devices. Online: https:\/\/www.shodan.io\/. https:\/\/www.shodan.io\/"},{"key":"e_1_3_2_1_58_1","volume-title":"Proc. of 30th The Web Conference (WWW). ACM","author":"Tehrani Pouyan Fotouhi","year":"2021","unstructured":"Pouyan Fotouhi Tehrani, Eric Osterweil, Jochen H. Schiller, Thomas C. Schmidt, and Matthias W\u00e4hlisch. 2021. Security of Alerting Authorities in the WWW: Measuring Namespaces, DNSSEC, and Web PKI. In Proc. of 30th The Web Conference (WWW). ACM, New York, USA, 2709--2720."},{"key":"e_1_3_2_1_59_1","doi-asserted-by":"publisher","DOI":"10.1109\/ECRIME.2017.7945057"},{"key":"e_1_3_2_1_60_1","doi-asserted-by":"publisher","DOI":"10.1109\/JSAC.2016.2558918"},{"key":"e_1_3_2_1_61_1","doi-asserted-by":"publisher","DOI":"10.1145\/2663716.2663731"},{"key":"e_1_3_2_1_62_1","doi-asserted-by":"publisher","DOI":"10.1145\/3419394.3424214"},{"key":"e_1_3_2_1_63_1","doi-asserted-by":"publisher","DOI":"10.1504\/IJICS.2010.031858"},{"key":"e_1_3_2_1_64_1","volume-title":"Proceedings of the APRICOT Conference. APNOG.","author":"Winstead Eddy","year":"2014","unstructured":"Eddy Winstead. 2014. Respoonse Rate Limiting with BIND. In Proceedings of the APRICOT Conference. APNOG."}],"event":{"name":"IMC '21: ACM Internet Measurement Conference","location":"Virtual Event","acronym":"IMC '21","sponsor":["SIGCOMM ACM Special Interest Group on Data Communication","SIGMETRICS ACM Special Interest Group on Measurement and Evaluation","USENIX Assoc USENIX Assoc"]},"container-title":["Proceedings of the 21st ACM Internet Measurement Conference"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3487552.3487835","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3487552.3487835","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,12,15]],"date-time":"2025-12-15T17:21:52Z","timestamp":1765819312000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3487552.3487835"}},"subtitle":["tracing the DDoS attack ecosystem from the internet core"],"short-title":[],"issued":{"date-parts":[[2021,11,2]]},"references-count":64,"alternative-id":["10.1145\/3487552.3487835","10.1145\/3487552"],"URL":"https:\/\/doi.org\/10.1145\/3487552.3487835","relation":{},"subject":[],"published":{"date-parts":[[2021,11,2]]},"assertion":[{"value":"2021-11-02","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}