open access

https://hdl.handle.net/2115/87037

Detection and Blocking of Anomaly DNS Traffic by Analyzing Achieved NS Record History

英語

2018

Asia-Pacific Signal and Information Processing Association

1586-1590

APSIPA Annual Summit and Conference 2018. Asia-Pacific Signal and Information Processing Association (APSIPA). 12-15 November 2018. Held at the Hawai’i Convention Center in Honolulu, Hawaii, USA

DNS (Domain Name System)-based name resolutionservice is one of the most fundamental Internet services for theInternet users and application service providers. In normal DNSbased domain name resolution, the corresponding NS recordsare required in prior to sending DNS query to the correspondingauthoritative DNS servers. However, in recent years, DNS basedbotnet communication has been observed in which botnet relatednetwork traffic is transferred via DNS packets. In particular,it is observed in some malware that DNS queries are sent toC&C servers using IP address directly without obtaining thecorresponding NS records. In this paper, we propose a novelmechanism to detect and block anomaly DNS traffic by analyzingthe achieved NS record history in an organization network. In theproposed mechanism, all DNS traffic of an organization netwokwill be captured and analyzed in order to extract the legitimateNS (Name Server) records and the corresponding glue A records(the IP address(es) of a name server) which will be stored in awhite list database. Then all the outgoing DNS query packetswill be checked and those destined to the IP addresses thatnot included in the white list will be blocked as anomaly DNStraffic. We have implemented a prototype system and evaluatedthe functionalities in an SDN-based experimental network. Theresults show that the prototype system works as expected and theproposed mechanism is capable of detecting and blocking somespecific types of suspicious DNS traffic.

会議発表論文

Version of Record

All the papers in APSIPA ASC 2018 are copyrighted by APSIPA.