SFDS: A Self-Feedback Detection System for DNS Hijacking Based on Multi-Protocol Cross Validation

Huang, Caiyun; Zhang, Peng; Sun, Yong; Zhu, Yanhe; Liu, Yang

doi:10.1109/ict.2019.8798832

Cited by 2 publications

(2 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Other papers focus on inspecting DNS data obtained by passively mirroring DNS traffic at the application layer at a non-authoritative point in the DNS chain. This includes dump of DNS flows at application layer at an ISP [7], at a LAN gateway [26], at a campus gateway [17] and using DNS data from the Farsight database [16]. It should be noted that the Farsight database is built upon voluntary participation by resolver owners, and so it is unlikely that queries towards intentionally malicious resolvers would be represented in this database.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Detecting DNS hijacking by using NetFlow data

Fejrskov¹,

Pedersen

Vasilomanolakis

2022

2022 IEEE Conference on Communications and Network Security (CNS)

View full text Add to dashboard Cite

DNS hijacking represents a security threat to users because it enables bypassing existing DNS security measures. Several malware families exploit this by changing the client DNS configuration to point to a malicious DNS resolver. Following the assumption that users will never actively choose to use a resolver that is not well-known, our paper introduces the idea of detecting client-based DNS hijacking by classifying public resolvers based on whether they are well-known or not. Furthermore, we propose to use NetFlow-based features to classify a resolver as well-known or malicious. By characterizing and manually labelling the 405 resolvers seen in four weeks of NetFlow data from a national ISP, we show that classification of both well-known and malicious servers can be made with an AUROC of 0.85.

show abstract

Section: Related Workmentioning

confidence: 99%

“…The maliciousness of DNS responses are evaluated using various techniques, such as by use of open threat intelligence [20] [17], by probing HTTP/POP3/ IMAP/SMTP services on the resolved IPs [13] [26], by detecting differences in responses for similar queries [7] and by detecting NS record changes [16].…”

Section: Related Workmentioning

confidence: 99%

Detecting DNS hijacking by using NetFlow data

Fejrskov¹,

Pedersen

Vasilomanolakis

2022

2022 IEEE Conference on Communications and Network Security (CNS)

View full text Add to dashboard Cite

show abstract

Hybrid Detection and Mitigation of DNS Protocol MITM attack based on Firefly algorithm with Elliptical Curve Cryptography

Padmavathi

2022

EAI Endorsed Trans Perv Health Tech

View full text Add to dashboard Cite

A Domain Name Server is a critical Internet component. It enables users to surf the web and send emails. DNS is a database used by millions ofcomputers to determine which address best answers a user’s query. DNS is an unencrypted protocol that may be exploited in numerous ways. The mostpopular DNS MITM attack uses DNS poisoning to intercept communications and fake them. DNS servers do not verify the IP addresses they forwardtraffic to. In DNS attacks, the attacker either targets the domain name servers or attempts to exploit system weaknesses. The Proposed FFOBLA-ECC model detects the DNS Spoofed nodes in a wireless network using the optimized firefly boosted LSTM with the help of TTL and RTR parametersreceived from the simulation environment and provides authentication between the nodes in order to mitigate it using the Elliptical curve cryptography. The proposed model results are different from the other methods and yield highly accurate results beyond 98% compared with the existing RF, ARF, and KNN methods.

show abstract

SFDS: A Self-Feedback Detection System for DNS Hijacking Based on Multi-Protocol Cross Validation

Cited by 2 publications

References 7 publications

Detecting DNS hijacking by using NetFlow data

Detecting DNS hijacking by using NetFlow data

Hybrid Detection and Mitigation of DNS Protocol MITM attack based on Firefly algorithm with Elliptical Curve Cryptography

Contact Info

Product

Resources

About