TrickleDNS: Bootstrapping DNS security using social trust

Sankararaman, Sriram; Chen, Jay; Subramanian, Lakshminarayanan; Ramasubramanian, Venugopalan

doi:10.1109/comsnets.2012.6151334

Cited by 1 publication

(1 citation statement)

References 21 publications

(27 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Under the assumption of a wide adoption of this novel architecture, DNS amplification attacks (see below) could be mitigated more easily. Another example is TrickleDNS [ 31 ], which aims to protect the integrity of Resource Records (RR) following a social relationship principle. Roughly, a new domain can join a trusted network, if it is endorsed by a minimum number of network participants.…”

Section: Related Workmentioning

confidence: 99%

Mining IP to Domain Name Interactions to Detect DNS Flood Attacks on Recursive DNS Servers

Alonso

Monroy

Trejo

2016

Sensors

View full text Add to dashboard Cite

The Domain Name System (DNS) is a critical infrastructure of any network, and, not surprisingly a common target of cybercrime. There are numerous works that analyse higher level DNS traffic to detect anomalies in the DNS or any other network service. By contrast, few efforts have been made to study and protect the recursive DNS level. In this paper, we introduce a novel abstraction of the recursive DNS traffic to detect a flooding attack, a kind of Distributed Denial of Service (DDoS). The crux of our abstraction lies on a simple observation: Recursive DNS queries, from IP addresses to domain names, form social groups; hence, a DDoS attack should result in drastic changes on DNS social structure. We have built an anomaly-based detection mechanism, which, given a time window of DNS usage, makes use of features that attempt to capture the DNS social structure, including a heuristic that estimates group composition. Our detection mechanism has been successfully validated (in a simulated and controlled setting) and with it the suitability of our abstraction to detect flooding attacks. To the best of our knowledge, this is the first time that work is successful in using this abstraction to detect these kinds of attacks at the recursive level. Before concluding the paper, we motivate further research directions considering this new abstraction, so we have designed and tested two additional experiments which exhibit promising results to detect other types of anomalies in recursive DNS servers.

show abstract

Section: Related Workmentioning

confidence: 99%