DNS Server Research Articles

Implementation Strategy Analysis of Network Security using dalo RADIUS and Pi-hole DNS Server to enhance Computer Network Security, Case Study: XYZ as a Fintech Company

According to the annual report by the National Encryption Agency in 2023, Indonesia had the highest number of cyber-attack sources, with over 1 million attacks, which has increased quite rapidly compared to the last 3 years. Several online media platforms have reported incidents of this nature over the past three years. Among the 10 institutions implicated in the present incident, it has been confirmed that 6 of them are Fintech institutions. The incident's factors are various, including the user's lack of awareness who accessed an unofficial website outside the company's production website. This act ultimately proved to be detrimental to the company. Therefore, this study highlights the importance of RADIUS (Remote Authentication Dial-In User Service) as a comprehensive security tool that contributes to mitigating unauthorized access and strengthening network defenses against emerging threats. This research focuses on XYZ, a Fintech Company, using it as a case study. The main discussion in this paper focuses on utilizing the daloRADIUS server to resolve authorization concerns regarding network security. Pi-hole DNS Server is also used in this research to block access to illegal sites such as pornography and online gambling. The results of this research are proof of the success of a combination of daloRADIUS server components, RADIUS router, and Pi-hole DNS Server in blocking users who are detected accessing illegal sites and are also observed regarding the use of daloRADIUS Server resources in a usage range ranging from 10 active users to 300 active users.

COMPARISON OF MACHINE LEARNING ALGORITHMS FOR DETECTION OF DATA EXFILTRATION OVER DNS

Nowadays, computers are indispensable for business processes and home users. The widespread use of the Internet provides convenience in many areas from education to research. However, most of the users are unaware of technical security measures and use the Internet unconsciously. This situation leads to inadequate security measures against cyber-attacks. Various trainings are organised for conscious and safe internet use, but these efforts are not enough. Therefore, artificial intelligence-based solutions that can detect cyber incidents and close security gaps are becoming necessary. DNS tunnelling is a method used by malware to leak data over the internet. Vulnerable computers can put users in difficult situations by learning IP addresses from the wrong DNS servers. Innovative methods have been developed to detect this tunnelling. Some methods can detect low and slow data leakage through DNS in real time. There are also hybrid DNS tunnelling detection systems that achieve high accuracy and F-score using packet length and specific features. Feature-based methods sensitive to cache characteristics effectively characterise DNS tunnelling traffic with low false detection rates. These methods offer effective strategies for internet security. In this study, the detection of DNS tunnelling attacks by machine learning algorithms on the CIC-Bell-DNS-EXF-2021 dataset was investigated.

Implementasi Authentication Captive Portal Pada Wireless Local Area Network di PT. St. Morita Industries

PT. St. Morita Industries has a Wireless Local Area Network (WLAN) which is used as a medium for exchanging data and information by utilizing wireless transmission media, WLAN currently uses WPA2-PSK as a security system to authenticate users to access the internet. However, the use of WPA2-PSK as WLAN security still has a weakness due to the use of the same 1 password for many users in order to connect to the WLAN hotspot will be an opportunity for cyber crime. This happens because it will be very easy for irresponsible users to enter the WLAN. Therefore, in this study, captive portal authentication will be applied as an effort to increase WLAN security replaces WPA2-PSK. This research process uses the Network Development Life Cycle (NDLC) method. All the configurations needed to build the captive portal authentication take advantage of the Winbox program. This research has resulted in a special user authentication limitation for users who have registered on the WLAN is permitted to access this company's internet. In addition, the Winbox program can also be used for monitoring all users connected to the WLAN, both active and inactive users. By setting up captive portal authentication on a WLAN network using a proxy routerboard device which comprises an IP address, DHCP server, hostpot setup, NAT firewall, and DNS server one can create a WPA2-PSK security system. This configuration is completed with the aid of the Winbox v3.37 software.

Analysis Server Security Assessment of Staffing Management Information System Using the NIST SP 800-115 Method at UIN Ar-Raniry Banda Aceh

Ar-Raniry State Islamic University management information system has been implemented based on technology. It becomes vulnerable to attacks brought on by weaknesses (vulnerabilities). The degree to which institutions are able to improve their access to authority inside the system is gauged by this research. To evaluate the server's dependability based on confidentiality, integrity, and availability, penetration testing is necessary. The NIST SP 800-115 approach, which comprises of four testing stages—planning, discovery, attack, and reporting—is used to conduct the server security assessment. The findings demonstrate the Security Management Information System contains nine vulnerabilities in various ways with varying improvements. Two of these vulnerabilities are classified as high threat: DNS Server Spoofed Request Amplification DDoS by blocking access from the public network or rejecting the query; and Interception Attack by enhancing the SSL/TLS protocol through a stunnel. The remaining seven vulnerabilities are classified as medium threat. However, Ar-Raniry's campus server vulnerability level is categorized as medium threat

Improved Intrusion Detection System to Alleviate Attacks on DNS Service

Improved Intrusion Detection System to Alleviate Attacks on DNS Service

Implementation of Security Information and Event Management (SIEM) for Monitoring IT Assets Using Alienvault OSSIM (Case Study: Udayana University Information Resources Unit)

One way that can be done to analyze cyber security equipment is by monitoring the logs it generates. Meanwhile, to be able to analyze the logs generated from each equipment requires a long time and has a high level of difficulty. When the management of the cyber security system is not going right, it causes the failure of the cyber security system. So a defense mechanism is needed on managing the log called Security Information and Event Management (SIEM) using Alienvault OSSIM tools. Threat Monitoring or monitoring of security threats in the Cyber world, is used to analyze, evaluate, and monitor network threats and as an end point for organizations to provide evidence of security threats, such as network intrusions, data exfiltration, ransomware and other malware attacks. The limitations of the problems carried out in this study were limited to Threat Monitoring using Alienvault OSSIM. There are 6 servers at the Udayana University Information Resources Unit (USDI) that are being monitored. Monitoring was carried out for 3 months. There were 230,622 Events or events that were collected as a whole. IT assets that have the most logs during monitoring are owned by DNS Servers with a total of 200,424 Events. There are 11 Event Names and 34 event logs that are discussed. The log is packaged in the form of a report along with an explanation, of course it can assist administrators in evaluating their IT assets. There is also an email notification feature using Gmail. Overall there are no attacks that are so significant with the low risk category. Alienvault OSSIM is proven to be able to carry out monitoring processes in real time properly and can help USDI to monitor the activities of its IT assets.

Measuring the Centrality of DNS Infrastructure in the Wild

The centralization of the global DNS ecosystem may accelerate the creation of an oligopoly market, thereby, increasing the risk of a single point of failure and network traffic manipulation. Earlier studies have revealed the level of centralization in terms of the market share of public DNS services and DNS traffic seen by major CDN providers. However, the level of centralization in the infrastructure of the DNS Ecosystem is not well understood. In this paper, we present a novel and lightweight measurement approach that effectively discovers resolver pools from a single probing point. We conduct an Internet-wide active measurement on the client-side as well as the server-side DNS infrastructure to assess the level of DNS centralization in terms of the supporting infrastructure. Our measurement results show that the DNS infrastructure is much more centralized than previously believed. Over 90% of forwarding resolvers are backed by less than 5% (4071) of indirect resolvers. Merely 0.45% (12,679) of all name servers across 1138 gTLDs, operated by just 10 DNS providers, provide authoritative domain resolution service for 48.5% (more than 100 million) of domain names. We also investigated several leading DNS providers in IP infrastructure, load distribution, and service geo-distribution. The findings of our measurements provide novel insights into the centrality of the DNS infrastructure, which will help the Internet community promote the understanding of the DNS ecosystem.

An experimental study for the performance assessment of the DNS server architecture on IPv6 network

In this paper, an experimental investigation is conducted to study the performance of the educational research domain name system (ER-DNS) hierarchical server network which works on internet protocol version 6 (IPv6) only, instead of the publicly available dual stack DNS root servers on the internet. There is a high probability of making the entire internet system unstable if any changes are made. Thus, we have created the experimental testbed, which functions similar to the existing live internet systems. It thus gives more flexibility to experiment and make technical and operational changes, without risking the stability and reliability of the internet system. In this paper, we have setup the entire DNS hierarchy starting from the root to the recursive servers with the top level domain (TLD) and domain authoritative name servers has been setup. This setup enables the queries to flow from the end user recursive servers to the domain authoritative server via the root as well as the TLD servers and provide the result to the end user. Query response in each of these servers were recorded to derive the response time, failure and successes to help in assessing the efficiency, behavior, functionality, stability and reliability of the ER-DNS architecture in IPv6 networks.

Hybrid Detection and Mitigation of DNS Protocol MITM attack based on Firefly algorithm with Elliptical Curve Cryptography

A Domain Name Server is a critical Internet component. It enables users to surf the web and send emails. DNS is a database used by millions of computers to determine which address best answers a user’s query. DNS is an unencrypted protocol that may be exploited in numerous ways. The most popular DNS MITM attack uses DNS poisoning to intercept communications and fake them. DNS servers do not verify the IP addresses they forward traffic to. In DNS attacks, the attacker either targets the domain name servers or attempts to exploit system weaknesses. The Proposed FFOBLA-ECC model detects the DNS Spoofed nodes in a wireless network using the optimized firefly boosted LSTM with the help of TTL and RTR parameters received from the simulation environment and provides authentication between the nodes in order to mitigate it using the Elliptical curve cryptography. The proposed model results are different from the other methods and yield highly accurate results beyond 98% compared with the existing RF, ARF, and KNN methods.

Dns Server And Web Server Simulation With Debian Operating System On Local Area Network

The web server can be implemented on a local network and accesses the ip address of web server. To make it easier to access the web server, a DNS server can be applied which can translate ip addresses into domain names. This study aims to provide an overview of how to implement a DNS server and web server with the Debian operating system on a local area network, translate ip addresses into domain names, and provide web server services for clients. Where the research method used is NDLC, using the NDLC method the research process can be repeated to get good results. The result of this research is that the web server can be run on the local network by accessing the domain that has been configured on the DNS server, namely dinakartika.com, where in its implementation a response time test has also been carried out with the result that the more users access, the greater the response time. got. for testing the performance of the web server to get results with more and more users accessing the greater the memory usage and for processor usage there is a not too large increase, while for the network to get results with more and more users accessing the web the bandwidth usage will also increase.

An intelligently distributed system for controlling information flows

The existing controlling software toolkit is represented by multiple software modules to ensure effective organizations management. An important most information systems component is the possibility of remote and distributed work in multi-user mode. At the same time, the disadvantages of multi-level TCP/IP routing, the presence of various CVE vulnerabilities contribute to data leakage and unauthorized changes. Based on these conclusions, the main purpose of the study can be identified – the development of an intelligently distributed traffic tunnelling system. The proposed approach uses deep learning models both for predicting IP address samples during initialization of a secure connection and for dynamic network traffic filtering in the DNS server. The proposed authentication algorithm based on the dynamic extension of the function made it possible to automate the trusted client’s authorization process, and the implementation of a combined decision–making system - to ensure the correct interaction of all software modules. The development result of the proposed system allowed both to reduce time costs when working with controlling information systems and to ensure safe interaction.

A model of a comprehensive phishing prevention system

In particular, the results of our analysis indicate that with the accumulation of large data sets (properties, conditions, influencing factors, consequences) it will be possible immediately obtain more accurate results about possible security events and thus reduce the amount of spent working time by at least 50%, taking into account costs time to eliminate the consequences of erroneous information security decisions that are of a subjective nature. The security administrator will reduce the time spent on risk analysis and prioritization, and will be able to start processing them almost immediately, which will increase the effectiveness of existing information protection mechanisms. According to the tasks, a model of a comprehensive phishing prevention system has been developed, which consists of a Telegram bot, a mobile application, a website, a browser extension, a shared database, and a DNS server. In this structure, the data collection processes are improved by increasing the number of participants in their formation. Data processing becomes faster due to automation, and data exchange is characterized by the standardization of the source. The system can also be used for the early detection of mass mailings. Such detection is based on estimating the number of transitions from one network to one link in a unit of time. The use of the system data will contribute to the safety of users and increase the effectiveness of CERT-UA, the Cyber Police, the National Bank of Ukraine, and the National Cybersecurity Coordination Center in the process of their operational interaction. The prospects for further research include the integration of artificial intelligence methods (BERT model) into the developed neural network infrastructure to improve the algorithms for identifying malicious resources. The development of the infrastructure also involves creating an API and its further use in messaging services (messengers, web resources with messaging function). Key words: cyber security, phishing, cyber risk.

Research of potential data leaks in information and communication systems

This article discusses the problem of ensuring the protection of user data in information systems. It is shown that classic information systems are represented by stationary and mobile communication devices focused on data exchange with digital space. The fundamental principles of user data exchange in the digital space are considered. It has been established that leading technology IT corporations collect data from user communication devices. It is shown that the organization of data collection is carried out by redirecting the DNS traffic of the communication device to the DNS servers of IT corporations, followed by its encryption using the DoH protocol. This makes it impossible for authorized services and departments of national states to control the users’ DNS traffic and ensures the monopoly position of IT corporations in the global digital market for collecting and analyzing user data. It is shown that the collection of user data is carried out with the aim of further monetization and influencing decisions made by users. DNS traffic of devices for communication with the digital space of the Internet is fixed. An audit of the recorded DNS traffic was performed, and as a result, specialized Internet resources were identified to be responsible for collecting and processing user data. It has been proved that the identified specialized Internet resources belong to IT corporations. Methods of identification of communication devices in digital space were considered. It is shown that the identification of communication devices is based on the collection of a unique set of data from each communication device. Based on each unique data set, a digital fingerprint of the communication device is formed, which is used for its further identification in the digital space. These approaches allow organizing protection against user data collection in information systems. Software and hardware implementations for protection against data collection from communication devices are proposed. It has been experimentally established that the combined use of the proposed software and hardware models provides the most effective protection against data collection from communication devices and does not affect the functionality of information systems.

Web browsing privacy in the deep learning era: Beyond VPNs and encryption

Web browsing privacy is a matter of paramount importance for the Internet users. While they try to protect themselves from being monitored by getting advantage of encryption or VPNs, users’ privacy is still unaccomplished, even taking into account the tangled web, with several domains visited at the same time in a single web page, or IP addresses of a cloud provider shared by several sites. In this work, we provide a novel approach to identify user web browsing that only takes into account the IP addresses that the user has connected to and without performing any DNS reverse resolutions. We use this sequence of addresses as an input of different state-of-the-art deep learning models, such as multi-layer perceptron and transformers, which are able to accurately identify which was the website actually visited among Alexa’s World Top 500 most visited domains. Moreover, we have also studied other factors, such as the dependence on the DNS server used to resolve the visited IP addresses, the accuracy for the top domains (e.g., Google, YouTube, Facebook, etc.), data augmentation by packet sampling simulation to improve our results, the impact on packet sampling and the fine-tuning and possible impact of model parameters or the scalability of our approach. We conclude that, using only a 10% of the packets, we can identify the visited website with an accuracy and F1 score between 94% and 95%.

Penerapan PI Hole DNS Server Sebagai ADS-Blocker Dan Sistem Filtering Website Pada Jaringan Hotspot

Abstract This research aims to build a Hotspot network infrastructure that is free from advertisements to maximize bandwidth usage, implement a virus prevention system by filtering websites, and reduce router performance in hotspot networks. This research uses the Network Development Life Cycle (NDLC) method. By using the research method, it is hoped that the author can define the process cycle of designing or developing a computer network system, especially in the process of implementing the Pi Hole DNS server as an ads-blocker and website filtering system on a hotspot network. The results of this study indicate that the application of a pi hole DNS server on a hotspot network can block advertisements on sites visited via a web browser on a hotspot network. In addition, the pi hole DNS server can also perform filtering on advertising provider sites and the pi hole DNS server does not reduce the quality of service on the hotspot network.
 Keywords: NDLC, pi hole, android, network, hotspot.

A Novel Zone-Walking Protection for Secure DNS Server

A zone walking attack is to get all existing domain information from a secured DNS server. NSEC3 protocol was proposed to defend against zone walking attacks in a secured DNS server, although NSEC3 uses more CPU time. In this paper, the authors have proposed two novel solutions to defend against the zone walking attack by addressing the efficiency issue of secure DNS protocol. They have simulated the proposed solution and analyzed it with different scenarios of the secure DNS server and attackers. The result of the experiment shows that the proposed solution Low Profiling can be effective against zone walking attacks for up to certain server-side and client-side parameters. The work can help researchers to understand how a new approach in the DNSSEC server can defend against zone walking attacks.

Using manufacturer usage descriptions for IoT network security: An experimental investigation of smart home network devices

The Internet of Things (IoT) has shown significant growth in the past decades. Recently, IoT networks have been subject to cybersecurity threats on multiple fronts. A lack of improvement in IoT infrastructures' cybersecurity may result in challenges with a broad impact, such as DDoS attacks that target global DNS services. This paper reviews existing solutions to mitigate attacks on and from IoT networks. As a specific mitigation approach, we propose the use of a standardized whitelisting method, namely Manufacturer Usage Description (MUD), which provides enhanced explainability over machine learning-based approaches and is complementary to them. For evaluating the use of MUD in IoT networks, we report a case study, which we conducted through traffic analysis of two IoT devices by detecting recognizable and distinctive traffic patterns, which demonstrate the feasibility of MUD-based intrusion prevention.

Hybrid Detection and Mitigation of DNS Protocol MITM attack based on Firefly algorithm with Elliptical Curve Cryptography

A Domain Name Server is a critical Internet component. It enables users to surf the web and send emails. DNS is a database used by millions ofcomputers to determine which address best answers a user’s query. DNS is an unencrypted protocol that may be exploited in numerous ways. The mostpopular DNS MITM attack uses DNS poisoning to intercept communications and fake them. DNS servers do not verify the IP addresses they forwardtraffic to. In DNS attacks, the attacker either targets the domain name servers or attempts to exploit system weaknesses. The Proposed FFOBLA-ECC model detects the DNS Spoofed nodes in a wireless network using the optimized firefly boosted LSTM with the help of TTL and RTR parametersreceived from the simulation environment and provides authentication between the nodes in order to mitigate it using the Elliptical curve cryptography. The proposed model results are different from the other methods and yield highly accurate results beyond 98% compared with the existing RF, ARF, and KNN methods.

Identification of pharming in communication networks using ensemble learning

Pharming scams are carried out by exploiting the DNS as the main weapon while phishing attacks employ spoofed websites that appear to be legitimate to internet users. Phishing makes use of baits such as fake links but pharming leverages and negotiates on the DNS server to move and redirect internet users to a fake and simulated website.Having seen several challenges through pharming resulting into vulnerable websites, personal emails and accounts on social media, the usage and reliability on internet calls for caution. Against this backdrop, this work aims at enhancing pharming detection strategies by adopting machine learning classification algorithms. To further obtain the best classification results, an ensemble learning approach was adopted. The algorithms used include K-Nearest Neighbors (KNN), Decision Tree, Random Forest, Gaussian Naive Bayes, Logistic Regression, Support Vector Machine, Adaptive Boosting, Gradient Boosting, and Extra Trees Classifier. During the testing process, the classifiers were tested against four popular metrics: accuracy, recall, precision, F1 score, and Log loss. The results demonstrate the performance of all algorithms used, as well as their relationships. The ensemble model that included Logistic Regression, K-Nearest Neighbors, Decision Tree, Support Vector Machine, Gradient Boosting Classifier, AdaBoost Classifier, Extra Trees Classifier, and Random Forest produced the best results after evaluating them on the two datasets. Random Forest Classifiers showed a better performance of the classifiers, with mean accuracies of 0.932 and 0.939, respectively for each of the datasets when compared to 0.476 and 0.519 obtained for Naive Bayes.

Campus Website Security Vulnerability Analysis Using Nessus

Agencies or organizations are competing to create websites for their agencies, where this website to make work easier or disseminate information to the public in this study is a college or campus website. With this website, many people access it, so there is a possibility of security holes, which can be exploited by irresponsible people. So that data can be manipulated, retrieved or otherwise to the detriment of one-sided or several parties. For this reason, we tried to analyze the vulnerability of a website using a software called Nessus. From the results of the scan, it was found that several vulnerabilities were found from each website with different vulnerability levels. Of the 3 websites that have the most vulnerabilities, web 1 is 14. Meanwhile, the vulnerability at the medium level is on web 2, which is 22%. For the vulnerability lies in a weak DNS Server.