@inproceedings{d55bb4ac84ba44a983c2044db2d127bf,
title = "Investigating DNS traffic anomalies for malicious activities",
abstract = "The Domain Name System (DNS) is one of the critical components of modern Internet networking. Proper Internet functions (such as mail delivery, web browsing and so on) are typically not possible without the use of DNS. However with the growth and commercialization of global networking, this protocol is often abused for malicious purposes which negatively impacts the security of Internet users. In this paper we perform security data analysis of DNS traffic at large scale for a prolonged period of time. In order to do this, we developed DNSPacketlizer, a DNS traffic analysis tool and deployed it at a mid-scale Internet Service Provider (ISP) for a period of six months. The findings presented in this paper demonstrate persistent abuse of the protocol by Botnet herders and antivirus software vendors for covert communication. Other suspicious or potentially malicious activities in DNS traffic are also discussed.",
author = "Fyodor Yarochkin and Vladimir Kropotov and Yennun Huang and Ni, {Guo Kai} and Kuo, {Sy Yen} and Chen, {Ing Yi}",
year = "2013",
doi = "10.1109/DSNW.2013.6615506",
language = "英语",
isbn = "9781479901814",
series = "Proceedings of the International Conference on Dependable Systems and Networks",
booktitle = "2013 43rd Annual IEEE/IFIP Conference on Dependable Systems and Networks Workshop, DSN-W 2013",
note = "2013 43rd Annual IEEE/IFIP Conference on Dependable Systems and Networks Workshop, DSN-W 2013 ; Conference date: 24-06-2013 Through 27-06-2013",
}