The Domain Name System (DNS) provides a translation between readable domain names and IP addresses. The DNS is a key infrastructure component of the Internet and a prime target for a variety of attacks. One of the most significant threat to the DNS's wellbeing is a DNS poisoning attack, in which the DNS responses are maliciously replaced, or poisoned, by an attacker. To identify this kind of attack, we start by an analysis of different kinds of response times. We present an analysis of typical and atypical response times, while differentiating between the different levels of DNS servers' response times, from root servers down to internal caching servers. We successfully identify empirical DNS poisoning attacks based on a novel method for DNS response timing analysis. We then present a system we developed to validate our technique that does not require any changes to the DNS protocol or any existing network equipment. Our validation system tested data from different architectures including LAN and cloud environments and real data from an Internet Service Provider (ISP). Our method and system differ from most other DNS poisoning detection methods and achieved high detection rates exceeding 99 . These findings suggest that when used in conjunction with other methods, they can considerably enhance the accuracy of these methods.
@cite_39: DNS is one of the internet's fundamental building blocks, used by various applications such as web and mail transfer. Therefore, monitoring DNS traffic has potential to detect host anomalies such as spammers and infected hosts in a network. However, previous works assume a small number of hosts or target on domain name anomalies, so that they cannot be applied to a large-scale networks due to performance issues. A large number of hosts and long-term tracing consume computational resources and make real-time analysis difficult. In this paper, we propose anomaly detection for DNS servers using frequent host selection, which selects only potential hosts and does not depend on the number of hosts. We evaluate the proposed system using DNS traffic for 6 months of tracing, and show that the system can feasibly handle hosts in the dataset and detect anomalies, such as mail servers suffering from spam and DNS servers are configured incorrectly.
@cite_39 focused on an anomaly detection system for DNS servers. Normally, dealing with large number of hosts can consume vast amounts of computational resources and make real-time analysis difficult due to traffic overload. They proposed anomaly detection for DNS servers that frequently invoke host selection in which only potential hosts are selected. They used a FIFO (First In First Out) based method for frequent host selection along with other statistics. They categorized packets by type such as DNS mail records (MX), regular DNS packets (A), error rate, etc. They proposed several heuristics, such as the number of queries and requests, where a slightly higher rate of queries requests was considered to indicate an attack. They identified attacks such as the spam Backscatter. This kind of spam consists of incorrectly automated bounce messages sent by mail servers, typically as a side effect of incoming spam (unsolicited messages). Their attack identification system achieved 68