Investigating DNS traffic anomalies for malicious activities

Fyodor Yarochkin, Vladimir Kropotov, Yennun Huang, Guo Kai Ni, Sy Yen Kuo, Ing Yi Chen

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

4 Scopus citations

Abstract

The Domain Name System (DNS) is one of the critical components of modern Internet networking. Proper Internet functions (such as mail delivery, web browsing and so on) are typically not possible without the use of DNS. However with the growth and commercialization of global networking, this protocol is often abused for malicious purposes which negatively impacts the security of Internet users. In this paper we perform security data analysis of DNS traffic at large scale for a prolonged period of time. In order to do this, we developed DNSPacketlizer, a DNS traffic analysis tool and deployed it at a mid-scale Internet Service Provider (ISP) for a period of six months. The findings presented in this paper demonstrate persistent abuse of the protocol by Botnet herders and antivirus software vendors for covert communication. Other suspicious or potentially malicious activities in DNS traffic are also discussed.

Original languageEnglish
Title of host publication2013 43rd Annual IEEE/IFIP Conference on Dependable Systems and Networks Workshop, DSN-W 2013
DOIs
StatePublished - 2013
Externally publishedYes
Event2013 43rd Annual IEEE/IFIP Conference on Dependable Systems and Networks Workshop, DSN-W 2013 - Budapest, Hungary
Duration: 24 06 201327 06 2013

Publication series

NameProceedings of the International Conference on Dependable Systems and Networks

Conference

Conference2013 43rd Annual IEEE/IFIP Conference on Dependable Systems and Networks Workshop, DSN-W 2013
Country/TerritoryHungary
CityBudapest
Period24/06/1327/06/13

Fingerprint

Dive into the research topics of 'Investigating DNS traffic anomalies for malicious activities'. Together they form a unique fingerprint.

Cite this