Trends in Host Search Attack in DNS Query Request Packet Traffic

Shibata, Nobuhiro; Musashi, Yasuo; Romaña, Dennis Arturo Ludeña; Kubota, Shinichiro; Sugitani, Kenichi

doi:10.1109/icinis.2012.11

Cited by 6 publications

(5 citation statements)

References 2 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Te two are combined to achieve an important component of Web3.0. [31]. Secondly, after years of improvement, DNS is a relevant secure system for user.…”

Section: Infuencementioning

confidence: 99%

The Review and Comparison between Centralized and Decentralized Digital Identity Systems

Li,

Jing,

Guan

2024

Mobile Information Systems

View full text Add to dashboard Cite

The growing capability of the digital world empowers physical objects to possess much more digital assets than they ever had, and the concepts of the Internet of Things and the Industrial Internet are coming out continually. Digital identity, a unique mark of two-way mapping, dynamic interaction between physical and virtual objects, is one of the fundamental elements among these novel concepts because it is the only way to distinguish each other from hundreds of millions of digital objects. In order to create a world with everything connected on the Internet, plenty of digital identity-orientated systems were raised, and new frameworks are emerging iteratively. To the best of our knowledge, this review lists some of the most applicable digital identity-based solutions by giving mechanism, digital identity solution, feature, and comparison between these models.

show abstract

“…Te two are combined to achieve an important component of Web3.0. [31]. Secondly, after years of improvement, DNS is a relevant secure system for user.…”

Section: Infuencementioning

confidence: 99%

The Review and Comparison between Centralized and Decentralized Digital Identity Systems

Li,

Jing,

Guan

2024

Mobile Information Systems

View full text Add to dashboard Cite

show abstract

“…Em ataques de reconhecimento de rede, o registro PTR é mais utilizado [Kumagai et al 2010]. Ataques de dicionário contra o servic ¸o SSH podem ser identificados através da distribuic ¸ão de frequência do registro reverso [Shibata et al 2012]. Por esses motivos, os tipos de registros de recursos são essenciais para detectar anomalias que utilizam o tráfego DNS.…”

Section: Antonakakis Et Al (unclassified

Identificação e Caracterização de Comportamentos Suspeitos Através da Análise do Tráfego DNS

Barbosa¹,

Souto²,

Feitosa³

et al. 2014

Anais Do XIV Simpósio Brasileiro De Segurança Da Informação E De Sistemas Computacionais (SBSeg 2014)

View full text Add to dashboard Cite

O Sistema de Nomes de Domínios (DNS) fornece mecanismos para traduzir os nomes de domínios em endereços IP. Este serviço é usado tanto por usuários legítimos quanto aplicações suspeitas que podem solicitar endereços dos servidores de email antes de enviar spam. Este trabalho apresenta uma metodologia que utiliza teoria dos grafos para distinguir padrões entre consultas legítimas e maliciosas no tráfego. As resoluções de nomes são modeladas em um grafo que ilustra o padrão de comunicação entre hosts e como as consultas foram realizadas. Para validação da proposta, o tráfego DNS do domínio .br é investigado. Os resultados mostram uma redução de 35% do total de hosts a serem analisados e a presença de comportamentos suspeitos.

show abstract

“…Consequently, it can be concluded that the DARC activity is almost the same load as the other A or PTR RR based DNS request packet traffic like the conventional DNS cache poisoning attack [8] or the host search (HS) activity [12]. Figure 14.…”

Section: Dns Query Loading Testsmentioning

confidence: 99%

“…Interestingly, however, the source IP address distributed activity was also reported in the host search (HS) activity [12] and the frequency distribution in the HS activity takes a range of 1.0-5.0 (day -1 ). This difference shows that the source IP address distributed DARC activity does not resem- Figure 14 Changes in the number of interrupts in vmstat system parameters at May 28th, 2013 (sec -1 unit).…”

Section: Frequency Distributions Of Euclidian Distance In Source Ip Amentioning

confidence: 99%

“…Step 1 Learning to produce a low-dimensional ─In this step, the clgrep, cngrep, and grep commands extract inbound ANY RR based DNS query request packet messages from the DNS query log file (/var/log/querylog) with discarding caseinsensitively keywords local and kumamoto-u, the sdis command prints out a syslog message if the Euclidean distance of two source IP addresses is calculated to be zero or to take a range of 1.0-5.0 [12], the dleven command prints out the syslog message if the restricted Damerau-Levenshtein distance LD(DN i , DN i-1 ) takes a zero value (as discussed in the Section 2.4), and the awk, sort, uniq, and qdos commands (lines 7 to 9 in Figure 4) compute and check the frequencies of the restricted Damerau-Levenshtein distance LD(DN i , DN i-1 ) and if the frequency exceeds a threshold value (Threshold=10), they write out the candidate IP addresses into a tmpfile as training data.…”

Section: ──mentioning

confidence: 99%

See 1 more Smart Citation

DNS ANY Request Cannon Activity in DNS Query Packet Traffic

Takeda¹,

Musashi²,

Sugitani³

et al. 2014

IJIES

Self Cite

View full text Add to dashboard Cite

Abstract:We statistically investigated the total ANY resource record (RR) based DNS query request packet traffic from the Internet to the top domain DNS server in a university campus network from January 1st, 2011 to December 31st, 2012. The obtained results are: (1) we found a significant increase in the inbound ANY RR based DNS query request traffic at November 28th, 2011. (2) In the DNS query request packet traffic, we observed only a query keyword of the campus domain name. (3) We found a correlation between the total inbound DNS query request packet traffic and the DNS query request packet traffic including the query keyword. (4) We also carried out the loading test sending ANY, A, and PTR RRs based unique DNS queries to a test DNS server, however, we observed no difference among the vmstat parameters based on the queries, and the load value was only 0.10-0.20. These results indicate that the ANY RR based DNS request packet traffic is quite strange. Therefore, we should pay much attention to the ANY RR based DNS query request traffic including the single domain name.

show abstract

Trends in Host Search Attack in DNS Query Request Packet Traffic

Cited by 6 publications

References 2 publications

The Review and Comparison between Centralized and Decentralized Digital Identity Systems

The Review and Comparison between Centralized and Decentralized Digital Identity Systems

Identificação e Caracterização de Comportamentos Suspeitos Através da Análise do Tráfego DNS

DNS ANY Request Cannon Activity in DNS Query Packet Traffic

Contact Info

Product

Resources

About