A Study on the Use of 3rd Party DNS Resolvers for Malware Filtering or Censorship Circumvention

Abstract

DNS resolvers perform the essential role of translating domain names into IP addresses. The default DNS resolver offered by an Internet Service Provider (ISP) can be undesirable for a number of reasons such as censorship, lack of malware filtering options and low service quality. In this paper, we propose a novel method for estimating the amount of DNS traffic directed at non-ISP resolvers by using DNS and NetFlow data from an ISP. This method is extended to also estimate the amount of DNS traffic towards resolvers that offer malware filtering or parental control functionality. Finally, we propose a novel method for estimating the amount of DNS traffic at non-ISP resolvers that would have been censored by ISP resolvers. The results of applying these methods on an ISP dataset shows to which extent 3rd party resolvers are chosen by users for either malware filtering or censorship circumvention purposes.

Detecting DNS hijacking by using NetFlow data

“…Finally, use of data from clients collected in the Open Observatory of Network Interference (OONI) database is used by Radu et al [21], and passively mirroring DNS traffic at the network/transport layer through NetFlow at a national ISP is used by Fejrskov et al [25]. Their focus is, however, on the use of major/well-known 3rd party resolvers, not on the more rarely used, potentially malicious resolvers.…”