Detection of NS Resource Record DNS Resolution Traffic, Host Search, and SSH Dictionary Attack Activities

Abstract

We carried out an entropy study on the DNS query traffic from the Internet to the top domain DNS server in a university campus network through January 1st to March 31st, 2009. The obtained results are: (1) We observed a difference for the entropy changes among the total-, the A-, and the PTR resource records (RRs) based DNS query traffic from the Internet through January 17th to February 1st, 2009. (2) We found the large NS RR based DNS query traffic including only a keyword "." in the total inbound DNS query traffic. (3) We also found that the unique source IP address based PTR DNS traffic entropy slightly increased, while the unique DNS query keywords based one drastically decreased in March 9th, 2009. We found a specific IP host which was an already-hijacked classical Linux PC that carried out the SSH dictionary attack to the Internet sites in March 9th, 2009. From these results,we can detect the unusual inbound NS RR based DNS traffic and the outbound SSH dictionary attacks by only watching DNS query traffic from the Internet.

A flow-based detection method for stealthy dictionary attacks against Secure Shell

“…From the experimental results, we intend to continue improving our method with the ultimate goal of being able to detect the dictionary attacks against many services to enable secure networks. Thames et al (Thames et al, 2008) log file high low yes yes no no Su et al (Su et al, 2011) log file high low yes yes no no Sperotto et al (Sperotto et al, 2009) traffic low not clear yes no no no Takemori et al (Takemori et al, 2009) traffic low high yes no no no Our work traffic low moderate yes yes yes yes j o u r n a l o f i n f o r m a t i o n s e c u r i t y a n d a p p l i c a t i o n s x x x ( 2 0 1 4 ) 1 e1 1…”

“…Sperotto et al (2009) showed that such attacks typically consist of three phases, and the authors represented their behaviors at flow level by Hidden Markov Model. Takemori et al (2009) discovered a significant upsurge in the number of PTR resource records in DNS traffic while the attacks were underway. This approach limits the above costs because its requirement is to only capture traffic at a few observation points.…”

“…Since even one success of these attacks causes serious problems, such as leaks of confidential information, transmission of spam email, and deployment of phishing sites, administrators should be prepared to cope with them. SSH dictionary attacks have been detected in two basic ways that rely on either log files (Thames et al, 2008;Su et al, 2011) or network traffic (Sperotto et al, 2009;Takemori et al, 2009). The first approach parses the log file of all hosts in large networks, and thereby imposes heavy maintenance costs on administrators.…”

A New Approach to Identify User Authentication Methods toward SSH Dictionary Attack Detection

“…Hellemons et al [10] showed that such attacks typically consist of three phases, and the authors represented their behaviors at the flow level by using a hidden Markov model. Takemori et al [11] discovered a significant upsurge in the number of pointer (PTR) resource records in DNS traffic while attacks were underway. To resolve the problems of these studies, we proposed a new approach [12] that detects dictionary attacks and their success or failure.…”

SSH Dictionary Attack and DNS Reverse Resolution Traffic in Campus Network

“…Previously, on the other hand, we reported that the DNS traffic and entropy based detection technologies of the inbound-and outbound SSH dictionary attacks in the campus network [9][10][11][12]. The DNS based detection system has a merit which observes only the DNS query request packet traffic between the DNS server and its clients i.e.…”