Assessing the Real-World Dynamics of DNS

Berger, Andreas; Natale, Eduard

doi:10.1007/978-3-642-28534-9_1

Cited by 8 publications

(2 citation statements)

References 2 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…However, inconstant mappings between domains and IP subnets are suspect [19], [8]. This concept is extended to the trees obtained from MAM.…”

Section: B Steadiness Metricsmentioning

confidence: 99%

“…Since, as shown in this paper, malicious domains often exhibit a higher variability in terms of IP addresses, our paper evaluates the dynamics of the aggregated data for detecting suspicious domains and/or IP addresses. From this perspective, [19] is a closely related work use manually fixed aggregation levels and does not aim to track suspect domains.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Multi-dimensional aggregation for DNS monitoring

Dolberg

Jérôme

Engel

2013

38th Annual IEEE Conference on Local Computer Networks

View full text Add to dashboard Cite

Abstract-DNS is an essential service in the Internet as it allows to translate human language based domain names into IP addresses. DNS traffic reflects the user activities and behaviors. It is thus a helpful source of information in the context of large scale network monitoring. In particular, passive DNS monitoring garnered much interest for the security perspectives by highlighting the services the machines want to access. In this paper, we propose a new method for assessing the dynamics of the match between DNS names and IP subnetworks using an efficient aggregating scheme combined with relevant steadiness metrics. The evaluation relies on real data collected over several months and is able to detect anomalies related to malicious domains.

show abstract

“…However, inconstant mappings between domains and IP subnets are suspect [19], [8]. This concept is extended to the trees obtained from MAM.…”

Section: B Steadiness Metricsmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Multi-dimensional aggregation for DNS monitoring

Dolberg

Jérôme

Engel

2013

38th Annual IEEE Conference on Local Computer Networks

View full text Add to dashboard Cite

show abstract

An efficient detection algorithm based on network delay estimation

Shi¹,

Ji²,

Zhang³

et al. 2017

AIP Conference Proceedings

View full text Add to dashboard Cite

DNS Noise: Measuring the Pervasiveness of Disposable Domains in Modern DNS Traffic

Chen

Antonakakis

Perdisci

et al. 2014

2014 44th Annual IEEE/IFIP International Conference on Dependable Systems and Networks

View full text Add to dashboard Cite

Abstract-In this paper, we present an analysis of a new class of domain names: disposable domains. We observe that popular web applications, along with other Internet services, systematically use this new class of domain names. Disposable domains are likely generated automatically, characterized by a "one-time use" pattern, and appear to be used as a way of "signaling" via DNS queries. To shed light on the pervasiveness of disposable domains, we study 24 days of live DNS traffic spanning a year observed at a large Internet Service Provider. We find that disposable domains increased from 23.1% to 27.6% of all queried domains, and from 27.6% to 37.2% of all resolved domains observed daily. While this creative use of DNS may enable new applications, it may also have unanticipated negative consequences on the DNS caching infrastructure, DNSSEC validating resolvers, and passive DNS data collection systems.

show abstract

Assessing the Real-World Dynamics of DNS

Cited by 8 publications

References 2 publications

Multi-dimensional aggregation for DNS monitoring

Multi-dimensional aggregation for DNS monitoring

An efficient detection algorithm based on network delay estimation

DNS Noise: Measuring the Pervasiveness of Disposable Domains in Modern DNS Traffic

Contact Info

Product

Resources

About