A Detection Method Against DNS Cache Poisoning Attacks using Machine Learning Techniques

Abstract

In this paper, we offer a machine learning-based enhanced detection strategy for DNS cache poisoning attacks. In addition to the standard DNS packet's five basic tuples, we plan to include numerous specific features that were extracted based on The heuristic components, such as the common DNS protocols "trigger," "time related features," and "GeoIP related features" of DNS cached data," etc.[1] By mapping IP and domain name, DNS's principal job is to lead users to the right computers, programmes, and data. Due to some DNS security weaknesses, attackers frequently use DNS-based malware, DNS-amplification, false-positive triggering, DNS tunnelling, etc. as a means of attack.[2] The upcoming effort comprises training with DNS traffic data and evaluations in both a small-scale experimental network and a large-scale real network environment.