Domain Name System Servers Research Articles

Pengujian High Availability pada Asynchronous DNS Berbasis Restknot menggunakan Algoritma Round Robin

The existence of the Domain Name System (DNS) through the role of the DNS Record, functions to translate domain addresses into IP addresses. High availability is an absolute condition so that the service from the DNS Server is still available and running well. To make this happen, it is necessary to have an asynchronous API on the DNS server and data management on the DNS record. This research designs and implements RESTKnot as an asynchronous API on DNS Server for DNS record management, accompanied by high availability testing using Load Balancing techniques and the Round Robin (RR) algorithm. The test results show that RESTKnot can help the DNS record management process dynamically, where DNS records can be made through the RESTKnot API and RESTKnot CLI, to be sent to the RESTKnot agent and executed by Knot DNS. The test results also show that RESTKnot can realize high availability through a ten-time system access test scenario, where heavy traffic on the first web server can be immediately diverted to the second web server to achieve high availability.

A novel deep-learning based approach to DNS over HTTPS network traffic detection

<div align="center"><span lang="EN-US">Domain name system (DNS) over hypertext transfer protocol secure (HTTPS) (DoH) is currently a new standard for secure communication between DNS servers and end-users. Secure sockets layer (SSL)/transport layer security (TLS) encryption should guarantee the user a high level of privacy regarding the impossibility of data content decryption and protocol identification. Our team created a <a name="_Hlk143263730"></a>DoH data set from captured real network traffic and proposed novel deep-learning-based detection models allowing encrypted DoH traffic identification. Our detection models were trained on the network traffic from the Czech top-level domain maintainer, Czech network interchange center (CZ.NIC), and successfully applied to the identification of the DoH traffic from Cloudflare. The reached detection model accuracy was near 95%, and it is clear that the encryption does not prohibit the DoH protocol identification.</span></div>

Enterprise DNS Asset Mapping and Cyber-Health Tracking via Passive Traffic Analysis

The Domain Name System (DNS) is a critical service that enables domain names to be converted to IP addresses (or vice versa); consequently, it is generally permitted through enterprise security systems (e.g., firewalls) with little restriction. This has exposed organizational networks to DDoS, exfiltration, and reflection attacks, inflicting significant financial and reputational damage. Large organizations with loosely federated IT departments (e.g., Universities and Research Institutes) often do not even fully aware of all their DNS assets and vulnerabilities, let alone the attack surface they expose to the outside world. In this paper, we address the "DNS blind spot" by developing methods to passively analyze live DNS traffic, identify organizational DNS assets, and monitor their health on a continuous basis. Our contributions are threefold. First, we perform a comprehensive analysis of all DNS traffic in two large organizations (a University Campus and a Government Research Institute) for over a month, and identify key behavioral profiles for various asset types such as recursive resolvers, authoritative name servers, and mixed DNS servers. Second, we develop an unsupervised clustering method that classifies enterprise DNS assets using the behavioral attributes identified, and demonstrate that our method successfully classifies over 100 DNS assets across the two organizations. Third, our method continuously tracks various health metrics across the organizational DNS assets and identifies several instances of improper configuration, data exfiltration, DDoS, and reflection attacks. We believe the passive analysis methods in this paper can help enterprises monitor organizational DNS health in an automated and risk-free manner.

Defending Root DNS Servers against DDoS Using Layered Defenses (Extended)

Distributed Denial-of-Service (DDoS) attacks exhaust resources, leaving a server unavailable to legitimate clients. The Domain Name System (DNS) is a frequent target of DDoS attacks. Since DNS is a critical infrastructure service, protecting it from DoS is imperative. Many prior approaches have focused on specific filters or anti-spoofing techniques to protect generic services. DNS root nameservers are more challenging to protect, since they use fixed IP addresses, serve very diverse clients and requests, receive predominantly UDP traffic that can be spoofed, and must guarantee high quality of service. In this paper we propose a layered DDoS defense for DNS root nameservers. Our defense uses a library of defensive filters, which can be optimized for different attack types, with different levels of selectivity. We further propose a method that automatically and continuously evaluates and selects the best combination of filters throughout the attack. We show that this layered defense approach provides exceptional protection against all attack types using traces of ten real attacks from a DNS root nameserver. Our automated system can select the best defense within seconds and quickly reduces traffic to the server within a manageable range, while keeping collateral damage lower than 2%. We show our system can successfully mitigate resource exhaustion using replay of a real-world attack. We can handle millions of filtering rules without noticeable operational overhead.

DNS-BC: Fast, Reliable and Secure Domain Name System Caching System Based on a Consortium Blockchain.

The Domain Name System (DNS) is a fundamental component of the internet, responsible for resolving domain names into IP addresses. DNS servers are typically categorized into four types: recursive resolvers, root name servers, Top-Level Domain (TLD) name servers, and authoritative name servers. The latter three types of servers store actual records, while recursive resolvers do not store any real data and are only responsible for querying the other three types of servers and responding to clients. Recursive resolvers typically maintain a caching system to speed up response times, but these caching systems have the drawbacks of a low real-time performance, a poor accuracy, and many security and privacy issues. In this paper, we propose a caching system based on a consortium blockchain, namely DNS-BC, which uses the synchronization mechanism of the consortium blockchain to achieve a high real-time performance, uses the immutable mechanism of the consortium blockchain and our designed credibility management system to achieve up to a 100% accuracy, and has been combined with encrypted transmission protocols to solve common security and privacy issues. At the same time, this caching system can greatly reduce the traffic that name servers need to handle, thereby protecting them from Denial-of-Service (DoS) attacks. To further accelerate the data transmission speed, we have designed a new encrypted DNS protocol called DNS over KCP (DoK). The DoK protocol is based on the KCP protocol, which is a fast and reliable transmission protocol, and its latency can reach one-third of that of TCP when the network environment deteriorates. In our experiments, the transmission time of this protocol is about a quarter of that of the widely used encrypted protocols DNS over TLS (DoT) and DNS over HTTPS (DoH).

A Multi-Path Approach to Protect DNS Against DDoS Attacks

Domain Name System (DNS) is considered a vital service for the internet and networks operations, and practically this service is configured and accessible across networks’ firewall. Therefore, attackers take advantage of this open configuration to attack a network’s DNS server in order to use it as a reflector to achieve Denial of Service (DoS) attacks. Most of protection methods such as intrusion prevention and detection systems use blended tactics such as blocked-lists for suspicious sources, and thresholds for traffic volumes to detect and defend against DoS flooding attacks. However, these protection methods are not often successful. In this paper, we propose a new method to sense and protect DNS systems from DoS and Distributed DoS (DDoS) attacks. The main idea in our approach is to distribute the DNS request mapping into more than one DNS resolver such that an attack on one server should not affect the entire DNS services. Our approach uses the Multi-Protocol Label Switching (MPLS) along with multi-path routing to achieve this goal. Also, we use threshold secret sharing to code the distributed DNS requests. Our findings and results show that this approach performs better when compared with the traditional DNS structure.

Real-time bot infection detection system using DNS fingerprinting and machine-learning

In today’s cyberattacks, botnets are used as an advanced technique to generate sophisticated and coordinated attacks. Infected systems connect to a command and control (C&C) server to receive commands and attack. Thus, detecting infected hosts makes it possible to protect the network’s resources and prevent them from illicit activities toward third parties. This research elaborates on the design, implementation, and results of a bot infection detection system based on Domain Name System (DNS) traffic events for a network corporation. An infection detection feasibility analysis is performed by creating fingerprints. The traces are generated from a numerical analysis of 13 attributes. These attributes are obtained from the DNS logs of a DNS server. It looks for fingerprint anomalies using Isolation Forest to label a host as infected or not. In addition, on the traces cataloged as anomalous, a search will be carried out for queries to domains generated by Domain Generation Algorithms (DGA). Then, Random Forest generates a model that detects future bot infections on hosts. The devised system integrates the ELK stack and Python. This integration facilitates the management, transformation, and storage of events, generation of fingerprints, machine learning application, and analysis of fingerprint classification results with a precision greater than 99%.

FECC: DNS tunnel detection model based on CNN and clustering

As the basic service of the network, the Domain Name System (DNS) is almost never blocked by the firewall. DNS tunnel takes advantage of this feature of DNS service to achieve barrier-free communication between the internal network and the external network, thereby implementing malicious network activities such as data theft and Command & Control (C2) control. As an intrusion means, DNS tunnel constitutes a serious threat to network security. At present, some research work on DNS tunnel detection is implemented based on manual features, which are “explicit” features. DNS tunnels can specifically circumvent these “explicit” features as they are designed, rendering detection methods ineffective. Additionally, the quality of these manual features also relies heavily on expert knowledge. The features extracted by the detection method based on convolutional neural network (CNN) have the characteristics of “implicit” that are not easily circumvented by DNS tunnels. However, the homogeneity and exclusivity of features are not considered in the existing research works that only perform the model training for classification tasks on datasets with limited sample types. This can cause the model to fail when detecting variants or new types of DNS tunnels. This paper proposes a novel DNS tunnel detection model, called FECC (Feature Extraction CNN and Clustering), to effectively detect various DNS Tunnel traffic. FECC takes the payload of the transport layer as input without preprocessing. The model uses a CNN-based module to extract features, then the homogeneity and exclusivity of features are evaluated based on the clustering method. FECC uses a cluster-based loss function to optimize the model parameters, which greatly improves the detection rate of the model for both classification tasks and unknown types of DNS tunnels, and further reduces the false positive rate. We have deployed a variety of DNS tunnel tools in the laboratory environment and constructed multiple datasets for sufficient comparison experiments. The experimental results show that FECC is a very effective DNS tunnel detection model.

Who is DNS serving for? A human-software perspective of modeling DNS services

The Domain Name System (DNS) is indispensable for almost all Internet services. It has been extensively studied for applications such as anomaly detection. However, the fundamental question of whether a DNS query from a querent (i.e., an IP address) is triggered by humans or issued by software entities remains unclear. Addressing this question enables us to profile the querent’s behavior from a human-software perspective, facilitating the understanding of “who is DNS serving for?”. In this study, we systematically performed querent-centric DNS modeling. Through in-depth measurements of three real-world DNS datasets of diverse origins, we developed an entropy-based method to distinguish between human and non-human queries and proposed a semi-supervised solution towards a community-level view for detecting and estimating software entities in a network. The solution can not only detect unknown software entities but is also NAT-compatible because it can detect and estimate software entities of multiple hosts NATed behind a single querent. An extensive evaluation demonstrates that our approach provides a new functionality for automatically disclosing the distinction between human and non-human domain names as well as a priori-independent and NAT-compatible functionality of discovering nearly 50% of the software entities and estimating their population using DNS queries.

An Exploration of the Adoption of DNSSEC by Businesses within the Norwegian ccTLD

The Domain Name System Security Extension (DNSSEC) is a cryptographic extension to the Domain Name System (DNS). The DNSSEC gives the DNS hierarchy a chain of trust from the root zone all the way down to the domain. By utilising DNSSEC, the client can verify that the DNS server’s response has not been tampered with in transit using strong trustworthy cryptographic algorithms. This paper presents a pilot research into the adoption of DNSSEC in Norwegian (.NO) ccTLD. The data set investigated in this researched a collection of Norwegian businesses that have a domain within the Norwegian ccTLD. This research found out that the Norwegian ccTLD adoption rate is amongst one of the highest compared to other ccTLDs. The DNSKEY resource records (RRs) collected in this research were used to identify some potential weaknesses. These possible weaknesses include the algorithm used, how long validity there was on the DNSKEY, and shared DNSKEY values across multiple domains.

A Comprehensive Review of DNS-based Distributed Reflection Denial of Service (DRDoS) Attacks: State-of-the-Art

Cyberattacks significantly impact the services based on the internet that is used in our daily lives. Any disruption will make it extremely difficult for us to carry out our daily activities. Cyberattacks will disrupt online services, exploit vulnerabilities to breach databases and servers, and so on. Various systems and services contribute to the Internet’s seamless functionality. The Domain Name System (DNS) is one of the most important services. DNS is used to resolve domain names into machine-readable IP addresses. DNS, like many other Internet services, is vulnerable to cyber-attacks. While DNS faces a slew of threats, one in particular appears to stand out. DNS is vulnerable to a variety of distributed denial-of-service attacks. The distributed reflection denial of service (DRDoS) attack, a flooding attack against DNS servers that renders them unavailable, disrupting domain name resolution activities, is one of the most common variants. DRDoS attacks have been on the rise in recent years. DNS lookup outages would significantly impact our online activities in the world of ultra-connectivity because they are typically the first step in establishing a connection with a server. The purpose of this paper is to present a state-of-the-art review of DRDoS attack detection and mitigation algorithms as well as the datasets on which these algorithms operate. Finally, we discussed each of these algorithms' relative merits and demerits.

DNSguard: A Raspberry Pi-Based DDoS Mitigation on DNS Server in IoT Networks

IoT development has increased the likelihood of several security attacks, such as Mirai, VPNFilter, and DNS (Domain Name System) flooding attacks. The DNS is a censorious component of smart home IoT infrastructure, a soft target for adversaries to launch DNS flooding attacks and impact poor QoS. This letter proposes DNSguard, a MUD-enabled two-level DNS flooding attack mitigation framework for IoT networks. DNSguard authenticates the behavioral profiles of Manufacturer Usage Description (MUD) compliant IoT devices and monitors traffic to detect and mitigate DNS flooding attacks at the local DNS server. The solution has been implemented using online DNS traffic in Raspberry Pi, and quantified response time decreased to 67.2%.

Beware of IPs in Sheep’s Clothing: Measurement and Disclosure of IP Spoofing Vulnerabilities

Networks not employing destination-side source address validation (DSAV) expose themselves to a class of pernicious attacks which could be prevented by filtering inbound traffic purporting to originate from within the network. In this work, we survey the pervasiveness of networks vulnerable to infiltration using spoofed addresses internal to the network. We issue recursive Domain Name System (DNS) queries to a large set of known DNS servers world-wide using various spoofed-source addresses. In late 2019, we found that 49% of the autonomous systems we tested lacked DSAV. After a large-scale notification campaign run in late 2020, we repeated our measurements in early 2021 and found that 44% of ASes lacked DSAV—though importantly, as this is an observational study, we cannot conclude causality. As case studies illustrating the dangers of a lack of DSAV, we measure susceptibility of DNS resolvers to cache poisoning attacks and the NXNS attack, two attacks whose attack surface is significantly reduced when DSAV in place. We discover 309K resolvers vulnerable to the NXNS attack and 4K resolvers vulnerable to cache poisoning attacks, 70% and 59% of which would have been protected had DSAV been in place.

Encrypted DNS: The good, the bad and the moot

Every connection to an Internet service requires a Domain Name System (DNS) lookup. Nevertheless, similar to other protocols used since the early days of the Internet, DNS was not designed with trust and security in mind. From a bird's eye view, the DNS threat model boils down to two types of attackers: off-path ones who can transmit packets but cannot observe the traffic, and on-path who sit either between the client and the recursive resolver, or between the recursive resolver and the DNS servers, and can read or modify packets.

Large-scale empirical evaluation of DNS and SSDP amplification attacks

Reflection-based volumetric distributed denial-of-service (DDoS) attacks take advantage of the available to all (open) services to flood and possibly overpower a victim’s server or network with an amplified amount of traffic. This work concentrates on two key protocols in the assailants’ quiver regarding DoS attacks, namely domain name system (DNS) and simple service discovery protocol (SSDP). Our contribution spans three axes: (a) We perform countrywide IP address scans (probes) across three countries in two continents to locate devices that run open DNS or SSDP services, and thus can be effectively exploited in the context of amplification attacks, (b) we fingerprint the discovered devices to derive information about their type and operating system, and (c) we estimate the amplification factor of the discovered reflectors through a dozen of diverse, suitably crafted DNS queries and a couple of SSDP ones depending on the case. The conducted scans span fifteen months, therefore comparative conclusions regarding the evolution of the reflectors population over time, as well as indirect ones regarding the security measures in this field, can be deduced. For instance, for DNS, it was calculated that the third quartile of the amplification factor distribution remains more than 30 for customarily exploited queries across all the examined countries, while in the worst case this figure can reach up to 70. The same figures for SSDP range between roughly 41 and 73 for a specific type of query. To our knowledge, this work offers the first full-fledged mapping and assessment of DNS and SSDP amplifiers, and it is therefore anticipated to serve as a basis for further research in this ever-changing and high-stakes network security field.

A Light-Weight Statistical Latency Measurement Platform at Scale

The statistical value of latencies between two sets of hosts over a given period, which is referred as to the statistical latency, can benefit many applications in the next-generation networks, for example, Network-in-a-Box-based resource provisioning. However, the existing methods can hardly achieve low measurement cost and high prediction accuracy simultaneously in large-scale scenarios. In this article, we design a light-weight statistical latency measurement platform named DMS (DNS-based statistical latency Measurement platform at Scale). DMS achieves high measurement accuracy by introducing a metric space to select the closest open recursive DNS (Domain Name System) server to a given host, and predicting the end-to-end latency between two hosts via the measured latency between the two corresponding DNS servers. To reduce the overall measurement overhead, DMS clusters the hosts in the metric space with the open recursive DNS infrastructure in the network as the cluster center, thus achieving low measurement cost and good scalability in large scale simultaneously. To evaluate the performance of DMS, we implement a prototype system in the network. Compared to the widely adopted method King, DMS can reduce the relative error by 18.5% for real-time end-to-end latency prediction and 33% for statistical latency prediction.

A Comprehensive Study of DNS Operational Issues by Mining DNS Forums

Domain Name System (DNS) is a fundamental component for today’s Internet communications, enabling the domain-to-IP translations for billions of users and numerous applications. Yet, the operational failures of DNS are not rare and sometimes lead to severe consequences like Internet outages. To gain a better understanding of DNS operational failures, previous works examined large-scale DNS logs (DNS queries and responses between Internet users and DNS servers), but the DNS logs cannot offer a comprehensive view of the failures (e.g., errors at domain registrars) and explain the failures at a finer grain. In this paper, we try to assess DNS operational failures from another data source, the supporting forums built by DNS service providers. Specifically, we mined 4 DNS forums and crawled more than 10000 posts and 50000 replies. With a new analysis framework developed by us, we are able to tag the forum posts by different categories (e.g., general concerns, issue locations, and record types), and gain new insights regarding how and why users encounter DNS failures. In the end, we offer suggestions to DNS service providers and users to mitigate DNS operational issues.

IDC: Elevating Network Security with DNS

The Domain Name System (DNS) is critical to the functioning of the Internet. And yet it's one of the most under-protected parts of the infrastructure. Attacks against DNS services can achieve devastating effects, from redirecting traffic to malicious sites to making whole swathes of the Internet inaccessible.

Building a DNS Tunneling Dataset

Background: Domain Name System (DNS) is considered the phone book of the Internet. Its main goal is to translate a domain name to an IP address that the computer can understand. However, DNS can be vulnerable to various kinds of attacks, such as DNS poisoning attacks and DNS tunneling attacks. Objective: The main objective of this paper was to allow researchers to identify DNS tunnel traffic using machine-learning algorithms. Training machine-learning algorithms to detect DNS tunnel traffic and determine which protocol was used will help the community to speed up the process of detecting such attacks. Method: In this paper, we considered the DNS tunneling attack. In addition, we discussed how attackers can exploit this protocol to infiltrate data breaches from the network. The attack starts by encoding data inside the DNS queries to the outside of the network. The malicious DNS server will receive a small chunk of data decoding the payload and put it together at the server. The main concern is that the DNS is a fundamental service that is not usually blocked by a firewall and receives less attention from systems administrators due to a vast amount of traffic. Results: This paper investigates how this type of attack happens using the DNS tunneling tool by setting up an environment consisting of compromised DNS servers and compromised hosts with the Iodine tool installed in both machines. The generated dataset contains the traffic of HTTP, HTTPS, SSH, SFTP, and POP3 protocols over the DNS. No features were removed from the dataset so that researchers could utilize all features in the dataset. Conclusion: DNS tunneling remains a critical attack that needs more attention to address. DNS tunneled environment allows us to understand how such an attack happens. We built the appropriate dataset by simulating various attack scenarios using different protocols. The created dataset contains PCAP, JSON, and CSV files to allow researchers to use different methods to detect tunnel traffic.

Toward Domain Name System privacy enhancement using intent‐based Moving Target Defense framework over software defined networks

AbstractMoving Target Defense (MTD) is an active security procedure while intent‐based networking (IBN) is gaining popularity as an evolving networking model. Software defined network (SDN) provides centralized network management through the control plane. In this article, a mechanism for the privacy enhancement of the Domain Name System (DNS) is proposed using intent‐based MTD over SDN. DNS is a critical internet service with a high risk of privacy disclosure as it is related to user preferences. The proposed model privacy enhancement using intent‐based MTD running over SDN (PEIMS) exploits IBN API of ONOS SDN controller along with Openflow flow modification for privacy enhancement. PEIMS core components include MTD application running over the ONOS SDN controller, ONOS intent‐based API, and the DNS server. The notion is the protection of privacy disclosures that occur during DNS queries. PEIMS provides a dynamic port shuffling technique for mapping DNS traffic to minimize the attacker's chances of observing the DNS queries responses. The proposed model was implemented using ONOS controller, ONOS north bound intent‐based API, and Mininet. The proposed model was evaluated in terms of privacy protection, attacker, and defender cost. The results showed promising trends for DNS privacy protection at a low computational cost. The work also quantified the privacy disclosures.