open access

https://hdl.handle.net/2115/91123

Policy-based Detection and Blocking System against Abnormal Applications by Analyzing DNS Traffic

英語

direct outbound communication

2023-10-16

IEEE

Conference Proceedings: 2023 22nd International Symposium on Communications and Information Technologies (ISCIT)

1-6

2023 22nd International Symposium on Communications and Information Technologies (ISCIT), 16-18 Oct, 2023. Aerial Function Centre, Sydney, Australia.

Bot-infected computers, which are compounded by botnet communication, conduct botnet-based cyber attacks using various application protocols. When using legitimate applications, a computer mostly performs domain name resolutions via the DNS full-service resolver of the organization network in advance for further communication with the application servers. During the domain name resolution, a DNS full-service resolver at least obtains the DNS NS (Name Server) records, the corresponding glue A records (IP address of the Name Server), and the application specific records, such as MX (Mail Exchange) record in case of mail transmission using Simple Mail Transfer Protocol (SMTP) of the target domain name. On the other hand, bot-infected computers with abnormal applications directly communicate with the application servers without obtaining these DNS records so that direct outbound application traffic will be generated. In this paper, we focus on this kind of direct outbound application traffic and propose a policy-based detection and blocking system against abnormal applications by analyzing DNS traffic. Specifically, the direct outbound application traffic without corresponding domain name resolutions will be detected and blocked as abnormal network traffic from bot-infected computers. We implemented a prototype system and conducted the feature evaluation on the SMTP protocol. The results confirmed that the proposed system worked correctly as designed.

会議発表論文

Accepted Manuscript

©2023 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.

2643-6140

2643-6175