NS record History Based Abnormal DNS traffic Detection Considering Adaptive Botnet Communication Blocking

Abstract

DNS (Domain Name System) based name resolution is one of the most fundamental Internet services for both of the Internet users and Internet service providers. In normal DNS based name resolution process, the corresponding NS (Name Server) records are required prior to sending a DNS query to the authoritative DNS servers. However, in recent years, DNS based botnet communication has been observed in which botnet related network traffic is transferred via DNS queries and responses. In particular, it has been observed that, in some types of malware, DNS queries will be sent to the C&C servers using an IP address directly without obtaining the corresponding NS records in advance. In this paper, we propose a novel mechanism to detect and block abnormal DNS traffic by analyzing the achieved NS record history in intranet. In the proposed mechanism, all DNS traffic of an intranet will be captured and analyzed in order to extract the legitimate NS records and the corresponding glue A records (the IP address(es) of a name server) which will be stored in a white list database. Then all the outgoing DNS queries will be checked and those destined to the IP addresses that are not included in the white list will be blocked as abnormal DNS traffic. We have implemented a prototype system and evaluated the functionality in an SDN-based experimental network. The results showed that the prototype system worked well as we expected and accordingly we consider that the proposed mechanism is capable of detecting and blocking some specific types of abnormal DNS-based botnet communication.

Policy-based Detection and Blocking System for Abnormal Direct Outbound DNS Queries using RPZ

“…Before the latency evaluation, we stored the destination IP addresses of the public DNS servers "8.8.8.8" and "1.1.1.1" to the DNS RPZ as legitimate in order to compare the latency of conventional domain name resolution. Furthermore, we also set up the previous system [12], [13] which used MySQL database in order to compare the latency with the proposed system using the DNS RPZ. As shown in Table 3, in the case of using the conventional DNS full resolver (172.16.100.13), the average latency for ten times of domain name resolution was 3,409.6ms in the previous system used MySQL database while that in the proposed system using the DNS RPZ was 2,406.4ms.…”

“…If the destination IP addresses are stored in the DNS RPZ the DNS query will be passed through, otherwise, the DNS query will be blocked. In the previous system [12], [13], we used MySQL database to store the DNS NS records and the glue A records. Accordingly, the destination IP address of each direct outbound DNS query needs to be verified by accessing the MySQL database using TCP connection which may cause unnecessary overhead.…”

“…Based on the above observation, we have ever considered and investigated the detection and blocking system for the botnet communication based on monitoring the direct outbound DNS queries by using NS record history database, which store NS records and the corresponding glue A records and verifies every direct outbound DNS query [12], [13]. Particularly, we created a database that stores the NS records and the corresponding glue A records in order to differentiate the normal and abnormal direct outbound DNS queries.…”

A hybrid method of genetic algorithm and support vector machine for DNS tunneling detection

“…Security threats take different forms, but one of these form is taking the advantage of domain name system (DNS) protocol for passing dangerous and malicious procedures, this attack attempt is known as DNS tunneling [1]. DNS is characterized by its simplicity where it intends to offer a straightforward way for accessing particular server through the domain name instead of the IP address [2][3][4][5]. Because of its simplicity, attackers attempt to use it for creating a tunnel to execute malicious scripts that intended to capture confidential information, gaining a super access, or attempting to harm the server [6].…”

A study of detection of abnormal network traffic: A comparison of multiple algorithms

“…With the rapid development of the internet, the network is becoming an indispensable part of people's daily study and work, bringing great convenience to people's production and life. The security problems in the network, however, are becoming more and more prominent, the spread of Trojan horses, 1 viruses, 2 malware, 3 and so forth is becoming increasingly widespread, and the means of network attacks are becoming increasingly advanced and hidden, 4 which affects not only the stable operation of the network but also national security 5 ; therefore, network security has become an increasingly important issue. Network traffic contains a large amount of information, and it is of great importance to protect network security if abnormal traffic can be detected in time.…”