Tracking anomalous behaviors of name servers by mining DNS traffic

Authors:
Yao Wang;Ming-zeng Hu;Bin Li;Bo-ru Yan
Affiliations:
Research Center of Computer Network and Information Security Technology, Harbin Institute of Technology, Harbin, Heilongjiang, China;Research Center of Computer Network and Information Security Technology, Harbin Institute of Technology, Harbin, Heilongjiang, China;Research Center of Computer Network and Information Security Technology, Harbin Institute of Technology, Harbin, Heilongjiang, China;Research Center of Computer Network and Information Security Technology, Harbin Institute of Technology, Harbin, Heilongjiang, China
Venue:
ISPA'06 Proceedings of the 2006 international conference on Frontiers of High Performance Computing and Networking
Year:
2006

Citing 3
Cited 1

An analysis of wide-area name server traffic: a study of the Internet Domain Name System

SIGCOMM '92 Conference proceedings on Communications architectures & protocols
DNS performance and the effectiveness of caching

IMW '01 Proceedings of the 1st ACM SIGCOMM Workshop on Internet Measurement
Impact of configuration errors on DNS robustness

Proceedings of the 2004 conference on Applications, technologies, architectures, and protocols for computer communications

A new statistical approach to DNS traffic anomaly detection

ADMA'10 Proceedings of the 6th international conference on Advanced data mining and applications - Volume Part II

Quantified Score

Hi-index	0.00

Visualization

Abstract

This paper seeks to quantitatively understand the nature of the current threat towards the common name servers. A new tracking technique based on statistical model is proposed to locate the anomalous name servers by analyzing the real-world DNS traffic. After summarizing the attacks towards DNS, the detection method based on associative feature analysis is presented. Experiments are conducted which highlighting both the payload anomaly and the data flow anomaly, and the experimental results reveal the efficiency of our method in detecting the anomalous behaviors of name servers.