Mining IP to Domain Name Interactions to Detect DNS Flood Attacks on Recursive DNS Servers

Area of Science:

• Cybersecurity
• Network Security
• Computer Science

Background:

• The Domain Name System (DNS) is vital network infrastructure and a frequent target for cyberattacks.
• Existing research primarily focuses on higher-level DNS traffic analysis, neglecting the recursive DNS level.
• The recursive DNS level is understudied yet crucial for network integrity and security.

Purpose of the Study:

• To introduce a novel abstraction for recursive DNS traffic to detect flooding attacks, a type of Distributed Denial of Service (DDoS).
• To develop and validate an anomaly-based detection mechanism for identifying DDoS attacks at the recursive DNS level.
• To explore the potential of DNS traffic abstraction for detecting other network anomalies.

Main Methods:

• Developed a novel abstraction of recursive DNS traffic based on the observation that queries form social groups.
• Implemented an anomaly-based detection mechanism using features that capture the DNS social structure.
• Utilized a heuristic to estimate group composition within DNS query patterns.

Main Results:

• Successfully validated the detection mechanism in a simulated and controlled environment.
• Demonstrated the suitability of the proposed abstraction for detecting flooding attacks at the recursive DNS level.
• Achieved promising results in detecting other types of anomalies in recursive DNS servers through additional experiments.

Conclusions:

• This work is the first to successfully use a DNS traffic abstraction to detect flooding attacks at the recursive level.
• The proposed abstraction offers a promising new direction for securing recursive DNS servers against various threats.
• Further research into this abstraction can lead to enhanced detection of diverse network anomalies.