MALICIOUS TRAFFIC DETECTION IN DNS INFRASTRUCTURE USING DECISION TREE ALGORITHM

The Domain Name System (DNS) plays a crucial role in connecting services and users on the Internet. Since its first specification, DNS has been extended in numerous documents to keep it fit for today’s challenges and demands. And these challenges are many. Revelations of snooping on DNS traffic led to changes to guarantee confidentiality of DNS queries. Attacks to forge DNS traffic led to changes to shore up the integrity of the DNS. Finally, denial-of-service attack on DNS operations have led to new DNS operations architectures. All of these developments make DNS a highly interesting, but also highly challenging research topic. This tutorial – aimed at graduate students and early-career researchers – provides a overview of the modern DNS, its ongoing development and its open challenges. This tutorial has four major contributions. We first provide a comprehensive overview of the DNS protocol. Then, we explain how DNS is deployed in practice. This lays the foundation for the third contribution: a review of the biggest challenges the modern DNS faces today and how they can be addressed. These challenges are (i) protecting the confidentiality and (ii) guaranteeing the integrity of the information provided in the DNS, (iii) ensuring the availability of the DNS infrastructure, and (iv) detecting and preventing attacks that make use of the DNS. Last, we discuss which challenges remain open, pointing the reader towards new research areas.

The main challenge facing IoT today is security. The constrained nature of IoT devices deprives them of using modern security solutions. This leads them to use aged and more vulnerable security mechanisms that expose them to high risks. When compared to more powerful devices, constrained IoT devices cannot use the Public Key Infrastructure with X.509 certificates to establish secure sessions. Moreover, the idea of self-signed certificates and having one trusted CA does not seem that popular. The Domain Name System (DNS) using the DNS-based Authentication of Named Entities protocol (DANE) and DNS's security extensions (DNSSEC) can help create the sought-after Public Key Infrastructure (PKI) for IoT. With a concrete example, this article explains how DNS can deliver IoT PKI functions based on DANE, backed by DNSSEC.

The Domain Name System (DNS) is a critical Internet infrastructure that provides name to address mapping services. In the past few years, distributed denial of service (DDoS) attacks have targeted the DNS infrastructure and threaten to disrupt this critical service. In this paper we show that the existing DNS can gain significant resilience against DDoS attacks through a simple change to the current DNS operations, by setting longer time-to-live values for a special class of DNS resource records, the infrastructure records. These records are used to navigate the DNS hierarchy and change infrequently. Furthermore, in combination with a set of simple and incrementally deployable record renewal policies, the DNS service availability can be improved by one order of magnitude. Our approach requires neither additional physical resources nor any change to the existing DNS design. We evaluate the effectiveness of our proposed enhancement by using DNS traces collected from multiple locations.

The Domain Name System (DNS) is an essential component of the critical infrastructure of the Internet. The role of DNS is vital, as it is involved in virtually every Internet transaction. It is sometimes remarked that DNS works well as it is now and any changes to it may disrupt its functionality and add complexity. However, due to its importance, an insecure DNS is unacceptable for current and future networks. The astonishing simplicity of mounting an attack against the DNS and the damaging potential of such an attack should convince practitioners and system administrators to employ a secure version of DNS. However, security comes with a cost. In this paper, we examine the performance of two proposals for secure DNS and we discuss the advantages and disadvantages of both. In particular, we analyze the impact that security measures have on the performance of DNS. While it is clear that adding security will lower DNS performance, our results show that the impact of security can be mitigated by deploying different security extensions at different levels in the DNS tree. We also describe the first implementation of the SK-DNSSEC [1] protocol. The code is freely downloadable and released under an open-source license.

A domain name system (DNS) is one of the most important infrastructures of the Internet communication. It is also a crucial point which is subjected to attacks. The largest distributed denial-of-service (DDoS) attack on October 21, 2016 has targeted a major DNS infrastructure named dynDNS. It was actually the Internet of Things (IoT) DNS flood attack that made more than half of websites in the United States unreachable for a significant amount of time. As we are using the Internet for everything in our life, especially health care and transportation, an attack of this type may cause a major disruption. Therefore, in this article, we are going to analyze the DNS flood attacks and propose two mitigation methods. We propose a load distributed mitigation process which will work as a quick escape route of the legitimate traffic from the attack field. Our solution mainly involves service level changes which can be implemented with collaboration among service providers. Also, our proposed solution is very cost effective as compared to the cost of downtime of the domain names caused by a DNS flood attack. Furthermore, we propose a benign-bot mitigation method and a business model for the method. In the benign-bot mitigation method, a bot program is installed in customers' DNS local servers to allow IP addresses of a list of paid businesses' websites to maintain in the caches so that the websites can be accessed even when the DNS servers are down.

Cyberattacks significantly impact the services based on the internet that is used in our daily lives. Any disruption will make it extremely difficult for us to carry out our daily activities. Cyberattacks will disrupt online services, exploit vulnerabilities to breach databases and servers, and so on. Various systems and services contribute to the Internet’s seamless functionality. The Domain Name System (DNS) is one of the most important services. DNS is used to resolve domain names into machine-readable IP addresses. DNS, like many other Internet services, is vulnerable to cyber-attacks. While DNS faces a slew of threats, one in particular appears to stand out. DNS is vulnerable to a variety of distributed denial-of-service attacks. The distributed reflection denial of service (DRDoS) attack, a flooding attack against DNS servers that renders them unavailable, disrupting domain name resolution activities, is one of the most common variants. DRDoS attacks have been on the rise in recent years. DNS lookup outages would significantly impact our online activities in the world of ultra-connectivity because they are typically the first step in establishing a connection with a server. The purpose of this paper is to present a state-of-the-art review of DRDoS attack detection and mitigation algorithms as well as the datasets on which these algorithms operate. Finally, we discussed each of these algorithms' relative merits and demerits.

The domain name system (DNS) is a complex distributed database on which most Internet services rely on. As its monitoring is critical, it is necessary to continuously monitor DNS traffic for identifying anomalies, measuring performance, and generating usage statistics. This paper describes the design and implementation of a distributed realtime DNS monitoring system, that is able to monitor the authoritative name servers of the it country code Top Level Domain (ccTLD). In addition to the production of usage records, it is able to understand trends, characterize economical relationships, and also track suspicious activities.

The proliferation of mobile devices and permanent Internet connectivity generates massive data flows that carry personal information and can compromise user privacy. This doctoral research focuses on analyzing privacy vulnerabilities in the Domain Name System (DNS), a fundamental protocol for Internet communications, and its encrypted variants. The research aims to develop novel methodologies that enhance DNS privacy protection while optimizing energy consumption. Initial contributions include the proposal of DNS query forgery techniques as privacy-enhancing mechanisms and the development of PARROT, a reproducible traffic capture system for mobile app analysis. The work demonstrates protocol evolution trends and validates privacy protection strategies through experimental evaluation using synthetic datasets. Future research will focus on energy-aware optimization of DNS privacy solutions and the development of practical implementations for mobile environments.

The Domain Name System - DNS is regarded as one of the critical infrastructure component of the global Internet because a large-scale DNS outage would effectively take a typical user offline. Therefore, the Internet community should ensure that critical components of the DNS ecosystem - that is, root name servers, top-level domain registrars and registries, authoritative name servers, and recursive resolvers - function smoothly. To this end, the community should monitor them periodically and provide public alerts about abnormal behavior. The authors propose a novel quantitative approach for evaluating the health of authoritative name servers – a critical, core, and a large component of the DNS ecosystem. The performance is typically measured in terms of response time, reliability, and throughput for most of the Internet components. This research work proposes a novel list of parameters specifically for determining the health of authoritative name servers: DNS attack permeability, latency comparison, and DNSSEC validation.

Random Subdomain DDoS attacks on the Domain Name System (DNS) infrastructure are becoming a popular vector in recent attacks (e.g., recent Mirai attack on Dyn). In these attacks, many queries are sent for a single or a few victim domains, yet they include highly varying non-existent subdomains generated randomly. Motivated by these attacks we designed and implemented novel and efficient algorithms for distinct heavy hitters (dHH). A (classic) heavy hitter (HH) in a stream of elements is a key (e.g., the domain of a query) which appears in many elements (e.g., requests). When stream elements consist of ikey, subkey? pairs, (idomain, subdomain?) a distinct heavy hitter (dhh) is a key that is paired with a large number of different subkeys. Our algorithms dominate previous designs in both the asymptotic (theoretical) sense and practicality. Specifically the new fixed-size algorithms are simple to code and with asymptotically optimal space accuracy tradeoffs. Based on these algorithms, we build and implement a system for detection and mitigation of Random Subdomain DDoS attacks. We perform experimental evaluation, demonstrating the effectiveness of our algorithms.

We discuss the primarily role of anonymity and identity manipulation in information warfare. We contend that those who engage in information warfare have very similar goals as those involved in cyber-crime and cyber-terrorism. Today Internet-based commerce has become global, representing a significant component of the world market. Network-based personal communications services are rapidly becoming the method of choice for many nations. In fact many critical infrastructure components are managed and controlled remotely. Yet these various capabilities are usurped by cyber-warriors, terrorists, or other criminals. A number of networking issues contribute to the current state of Information Warfare. Historically, security capabilities (e.g., authentication, authorization, and confidentiality services) had not been considered a high priority in the original design of the critical Internet protocols still in use. Further complicating the security problem is the lack of consistency in name scheme adopted for network-related objects (hosts, applications, interfaces). Mapping of object names continues to be a trial-by-error exercise, which is frequently misused by malicious actors, as in the case of Address Resolution Protocol (ARP). Moreover, the lack of authentication facilitates the use of ICMPv4 (internet control message protocol version 4) and UDP (user datagram protocol) as protocols of choice for distributed denial-of-service (DDoS) attacks. Dynamically used transport protocol port numbers are now common: negating the effectiveness of classic firewall type packet filtering. Regrettably, mapping of device domain names to IP (internet protocol) addresses via DNS (domain name system) continues with no major efforts to prevent invalid updates or query responses. Many of the aforementioned protocols rely on data-origin authentication via secret key and message digests, yet, secret key management is non-existent. IEEE 802.1X, used in newer wireless networks, is routinely avoided for wired infrastructures. Although internet protocol security (IPsec) is widely available, it is rarely deployed beyond secure virtual private networks (VPNs), especially given that its availability in IPv4 is optional and usage optional with IPv4 and IPv6. Domain name system security (DNSSEC) has existed for over 10 years, yet serious discussion for its deployment is only now occurring. The standards for public key infrastructures (PKIs) and digital certificates are extensive but the majority of organizations find excuses to avoid its use and most PKI-enabled applications cannot even check for revoked certificates. In conclusion, we contend that given the security threats associated with current and future information warfare activities, the inter-networked global community should focus on more rapid implementation and deployment of the existing security mechanisms. As such, mandatory, robust authentication as well as several key network security services should be adopted. The necessary mechanisms already exist, now is the time for network administrators to recognize the need for prompt deployment of these capabilities as a proactive defense/mitigation against malicious attacks at reasonable level.

Electronic Integrated Antenatal Care (e-iANC) was built as a web-based application to assist midwives in recording Antenatal Care (ANC) data including Patient Registration; Anamnesis; Physical Examination; Laboratory Test, Screening of Risk Pregnancy; Communication, Information and Education; Treatment and follow-up; Patient Disposition. To ensure e-iANC becomes a safe system, security system testing was needed. Our goals were to test the security system by using the Open Web Application Security Project (OWASP). It was conducted in computer laboratory at Universitas Esa Unggul Jakarta in August 2017. The OWASP detect include Injection, Broken Authentication and Session Management, Cross-Site Scripting (XSS), Insecure Direct Object References, Security Misconfiguration, Sensitive Data Exposure, Missing Level Access Control, Cross Site Request Forgery (CSRF), Using Known Vulnerable Components, Unvalidated Redirects and Forwards. The results indicated the risk level of e-iANC was the low category in the aspect of Cross-Domain JavaScript Source File Inclusion, Private IP Disclosure, XSS Protection Not Enabled Web Browser.

Today’s networks are growing rapidly and the network sector is an important factor in developing a variety of applications and services. At the same time, a variety of malicious traffic is occurring that threatens the network environment, and it is causing massive damage to the network environment. Thus research to analyze and detect malicious traffic is essential in the field of network management. In this paper, we propose a method based deep-learning to distinguish only malicious traffic from a set of traffic mixed with normal traffic. We intend to test a variety of different groups of experiments using the proposed malicious traffic detection model. We will improve and enhance our detection model through analysis of the result.

Deep learning-based models demonstrate a remarkable level of accuracy in network traffic identification. However, the black-box nature of neural networks often makes the identification results difficult to explain. Although some eXplainable Artificial Intelligence (XAI) methods have been applied to network traffic identification, most of them focus on model explainability and do not provide sufficient credibility. In emerging network systems that use proprietary protocols, low-credibility malicious traffic detection can result in severe consequences. Therefore, it is imperative to deeply understand network traffic features and trust the detection results. In this paper, we propose an explainable architecture for emerging network systems. This architecture enhances the explainability of malicious traffic detection from both input and output perspectives, aiming to understand network traffic data and improve the reliability of the results. The effectiveness of explaining inputs and outputs is verified through experimental analysis in case studies. Furthermore, we review the research on explainable models in the field of network traffic identification and summarize research opportunities.

Results in heart disease classification that are inaccurate and have low accuracy can endanger the patient's life. Some parameters in the algorithm model also influence classification. This study compares the Decision Tree and Random Forest algorithms for heart disease. The influence of maximum depth on heart disease classification also has significant implications. If the maximum depth is not set correctly, the classification results can be inaccurate and lead to incorrect diagnoses. This study uses five data split schemes, namely 60%: 40%, 70%: 30%, 75%: 25%, 80%: 20%, 90%: 10% and tested with different max depth parameters, namely max depth = 3, 4, 5, 6, and 7. This research produces the best accuracy using the 90%:10% scheme and max depth = 7 with the best accuracy result using the Random Forest algorithm of 99.29% while the Decision Tree algorithm is 98.05%. Then the precision and recall value of the Random Forest algorithm is 99% while the Decision Tree is 98%. The results of computation time using Decision Tree are faster than using Random Forest with a computation time for training data of 0.0075 s, while the testing data are 0.009 s. In future research, research can be conducted on the effect of other parameters by testing using several data sets.