A Survey on Malicious Domains Detection through DNS Data Analysis

Deepdom: Malicious domain detection with scalable and heterogeneous graph convolutional networks

A deep dive into DNS behavior and query failures

The Domain Name System (DNS) is an essential part of the Internet on whose function many other protocols rely. One key DNS function is Dynamic Update, which allows hosts on the network to make updates to DNS records dynamically, without the need for restarting the DNS service. Unfortunately, this dynamic process does expose DNS servers to security issues. To address these issues two protocols were introduced: Transaction Signature (TSIG) and Domain Name System Security Extensions (DNSSEC). In Internet Protocol version 4 (IPv4) networks using these protocols eliminated security issues. In Internet Protocol version 6 (IPv6) however, there is an issue with the DNS authentication process when using the Stateless Address Auto Configuration (SLAAC) mechanism (new to IPv6, nonexistent in IPv4). This authentication issue occurs when a node wants to update its resource records on a DNS server, during the DNS update process, or when a client wants to authenticate a DNS resolver to ensure that the DNS response does not contain a spoofed source address or message. In this paper we propose the use of a new mechanism which makes use of asymmetric cryptography to establish a trust relationship with the DNS server. We also consider the use of the current security parameters used to generate IPv6 addresses in a secure manner, i.e. Secure Neighbor Discovery (SeND), for assuring clients and DNS servers that the one they are communicating with is the real owner of this IP address. Since we are extending the RDATA field within the TSIG protocol to accommodate these new security parameters, we will call this new mechanism the CGA-TSIG algorithm.

The existence of the Domain Name System (DNS) through the role of the DNS Record, functions to translate domain addresses into IP addresses. High availability is an absolute condition so that the service from the DNS Server is still available and running well. To make this happen, it is necessary to have an asynchronous API on the DNS server and data management on the DNS record. This research designs and implements RESTKnot as an asynchronous API on DNS Server for DNS record management, accompanied by high availability testing using Load Balancing techniques and the Round Robin (RR) algorithm. The test results show that RESTKnot can help the DNS record management process dynamically, where DNS records can be made through the RESTKnot API and RESTKnot CLI, to be sent to the RESTKnot agent and executed by Knot DNS. The test results also show that RESTKnot can realize high availability through a ten-time system access test scenario, where heavy traffic on the first web server can be immediately diverted to the second web server to achieve high availability.

The Domain Name System (DNS) is a vital component of the Internet, used for all the operations performed over the network and, recently, also for protecting users from malicious activities. In this work, we analyze the behavior of DNS resolvers provided by three main Italian ISPs and contrast them with open, public resolvers provided by Google and Cisco. We consider two aspects. The first one is the time spent to perform a query and obtain a response from the resolvers, which has a considerable impact on the performance of most applications on the Internet. The second one is the capability to recognize domains associated with malicious activities, blocking related requests to protect users. The DNS response time is generally shorter for local resolvers since they are closer to the users. On the other hand, public resolvers are typically considered more efficient in detecting malicious domains. We performed a large number of DNS queries towards the different resolvers, both local and public, using different sets of domain names and different Internet access networks from main Italian providers. Our results confirm that the response time of local resolvers is shorter than the public ones. However, they also show that, unexpectedly, the protection level of local resolvers is largely comparable with the one of public resolvers. Consequently, you do not have to trade off security against performance. In addition, we study the impact of DNS over HTTPs, we unveil the different mechanisms implemented to block users from accessing malicious domains and assess the impact of caching on the obtained results.

Domain Name System (DNS) enables users to access websites via domain names, offering convenient navigation. However, criminals can exploit this convenience to redirect connections from user devices to fake servers for a variety of purposes. A form of attack known as DNS cache poisoning exploits vulnerabilities in the Domain Name System (DNS) to redirect connections from a legitimate website address to an illegitimate one. As a consequence of the fact that users of networked systems are typically unaware that they are accessing an illegitimate site, this attack can have a particularly damaging impact. Such incidents can give rise to several issues, including the theft of data, the distribution of malware, and other security threats. To address this issue, this study employs a firewall in conjunction with DoH (DNS over HTTPS) and the utilization of registered certificates. The Domain Name System over HTTPS (DoH) protocol encrypts DNS requests and responses, preventing third parties (such as attackers who manipulate DNS) from reading or modifying DNS requests. The data employed in this study is derived from a review of existing literature. Furthermore, this study employs the PPDIOO model (Preparation, Planning, Design, Implementation, Operation, and Optimization) for the development of the network. Furthermore, the Mikrotik RB951ui-2Hnd routerboard is employed in this study. The outcome is the implementation of a multifaceted security strategy that effectively mitigates DNS cache poisoning attacks by 100%, while simultaneously reducing CPU usage to 11.5%. This approach enhances the security and reliability of user search activities on the internet.

Securing the internet’s backbone: A blockchain-based and incentive-driven architecture for DNS cache poisoning defense

The Domain Name System (DNS) is a fundamental service of the Internet, and the DNS tunnel is one of the most threatening abuses of DNS, posing a huge threat to user privacy and Internet security. Attackers conceal the information into DNS packets to evade firewalls and intrusion detection systems. Recently, newly developed DNS tunnels used by Advanced Persist Threat groups tend to use A and AAAA resource records (RRs) for transmission, making them more invisible and more threatening. Previous DNS tunnel detection approaches mainly focus on subdomains and TXT RRs, but less attention has been paid to newly developed DNS tunnels based on A and AAAA RRs. In this paper, we present a novel DNS tunnel detection method that can detect newly developed A and AAAA RR based DNS tunnels. Since DNS tunnels will transmit a large amount of encrypted or encoded data in the DNS queries and responses, we extracted novel features from domains and 4 types of RRs (A, AAAA, TXT and CNAME RRs) that are most commonly used for tunneling to measure the amount and content of information exchanged between the authoritative nameservers and the clients. We also analyze the detection capabilities when different features were used. The anomaly detection algorithm is employed on domains related features and 4 types of RRs related features, respectively. The overlaps of outliers will be marked as DNS tunnels. Our approach has been evaluated on real-world network traffic. The experimental results show that our approach can detect all DNS tunnels in the dataset with a extremely low false positive rate.

Malicious activities on the Internet are one of the most dangerous threats to users and organizations. Because of the flexibility a nd accessibility of domains, cyber criminals often utilize them to launch cyber attacks such as phishing or malware. Most of traditional malicious domain detection methods rely on feature engineering to learn the patterns of malicious domains. However, these methods can be easily evaded by some sophisticated evasion techniques such as Domain-flux or Fast-flux. Some recent studies utilized graph-based models to infer malicious domains and achieved better performance, yet without a fine-grained modeling of DNS scenarios. In this paper, we propose an attributed heterogeneous graph neural network model, GAMD, to detect malicious domains in a semi-supervised learning paradigm. Concretely, we utilize attributed heterogeneous information network to model the DNS scenarios with different types of nodes including domain, host, resolved-IP and different types of relation, such as request and resolution relations. We then design a fine-grained node type-aware feature transformation and edge type-aware aggregation mechanism to fuse the node attributes and structure information simultaneously and complete the inference over DNS graphs. In the experiments, we evaluate the performance of our model on a large-scale realworld passive DNS data and show that the proposed method outperforms the state-of-the-art in most evaluation metrics.

The Domain Name System (DNS) as the foundation of Internet, has been widely used by cybercriminals. A lot of malicious domain detection methods have received significant success in the past decades. However, existing detection methods usually use classification-based and association-based representations, which are not capable of dealing with the imbalanced problem between malicious and benign domains. To solve the problem, we propose a novel domain detection system named KSDom. KSDom designs a data collector to collect a large number of DNS traffic data and rich external DNS-related data, then employs K-means and SMOTE method to handle the imbalanced data. Finally, KSDom uses Categorical Boosting (CatBoost) algorithm to identify malicious domains. Comprehensive experimental results clearly show the effectiveness of our KSDom system and prove its good robustness in imbalanced datasets with different ratios. KSDom still has high accuracy even in extremely imbalanced DNS traffic.

Domain Name System (DNS) Service is the basic support of Internet, which security plays a vital role in the entire Internet. Because DNS requests and responses are mostly UDP-based, and the existing large numbers of open recursive DNS servers, it is vulnerable to distributed denial of services (DDoS) attacks. Through the analysis of several aspects of these attacks, a novel approach to detect DDoS attack is proposed based on characteristics of attack traffics (CAT) time series. Then CAT time series are transformed into a multidimensional vector series and a support vector machine (SVM) classifier is applied to identity the attacks. The experiment results show that our approach can identify the state features of the abnormal flow due to the DDoS attacking flows, and detect DDoS attacks accurately DOI : http://dx.doi.org/10.11591/telkomnika.v12i1.3355

Recent concerns over the privacy implications of the Domain Name System (DNS) have led to encrypting DNS queries and responses through protocols like DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT). Although the trend towards encryption is a positive development, the accompanying centralization of the DNS has fomented tussles involving ISPs, browser and device vendors, content delivery networks, and users. This paper articulates several current DNS tussles and offers principles to guide system design and implementation such that all stakeholders in the space could participate. We argue that refactoring name resolution in a stub resolver that is separate from devices and applications can preserve the benefits of encrypted DNS while satisfying other architectural desiderata, including performance, resilience, and privacy.

HANDOM: Heterogeneous Attention Network Model for Malicious Domain Detection

Tunneling and exfiltration over Domain Name System pose a threat in the cybersecurity landscape. In this work, we propose an unsupervised learning approach, namely SelfOrganizing Maps, to explore the tunneling behaviours in Domain Name System traffic. We perform evaluations on eight different combinations of datasets against state-of-the-art techniques. Results show that our approach demonstrates a robust ability to separate benign and tunneling behaviours across a variety of training schemes, where F1 measure reaches 99% across the different testing conditions.

Threats related to computer security constantly evolving and attacking the networks and internet all the time. New security threats and the sophisticated methods that hackers use can bypass the detection and prevention mechanisms. A new approach which can handle and analyze massive amount of logs from diverse sources such as network packets, Domain name system (DNS) logs, proxy logs, system/service logs etc. required. This approach can be typically termed as big data. This approach can protect and provide solution to various security issues such as fraud detection, malicious activities and other advanced persistent threats. Apache spark is a distributed big data based cluster computing platform which can store and process the security data to give real time protection. In this paper, we collect only DNS logs from client machines in local area network (LAN) and store it in a server. To find the domain name as either benign or malicious, we propose deep learning based approach. For comparison, we have evaluated the effectiveness of various deep learning approaches such as recurrent neural network (RNN), long short-term memory (LSTM) and other traditional machine learning classifiers. Deep learning based approaches have performed well in comparison to the other classical machine learning classifiers. The primary reason is that deep learning algorithms have the capability to obtain the right features implicitly. Moreover, LSTM has obtained highest malicious detection rate in all experiments in comparison to the other deep learning approaches.