Making DNS Servers Resistant to Cyber Attacks: An Empirical Study on Formal Methods and Performance

Abstract

IRONSIDES is an open-source Domain Name System (DNS) server designed using formal methods to reduce DNS vulnerabilities to cyber attacks. The use of formal methods gives IRONSIDES provable security properties, including the absence of numerous security flaws that plague BIND and Windows DNS. It also raises an empirical question: Does the use of formal methods to generate provably secure code require sacrificing performance? We present the results of an experimental investigation to answer this question. We compared IRONSIDES to BIND, Windows DNS, and numerous other DNS servers on both Windows and Unix. Our results show IRONSIDES performs quite well compared to other DNS servers, both proprietary and open-source, particularly given the resources expended in its development. This suggests that, at least in the DNS domain, increasing security with formal methods to render them less vulnerable to cyber attacks does not require sacrificing performance.