Domain Name System Research Articles

Implementation of Mail Server Based Of Squirrelmail Using Virtualization Technology at Universitas Muhammadiyah Sumatera Utara

Server virtualization technology is the use of one physical machine by several server operating systems. The design and implementation of this mail server was built using Debian.5 as the base operating system server. The design and implementation of mail servers is built using the dns server, web server and mail server / squirrelmail, configured using the help of the virtualbox application as a server. DNS (Domain Name System) is a system that stores information about host names and domain names in the form of scattered databases (distributed databases) on a computer network, for example the Internet. The application used to handle the delivery of mail messages is the mail server. This mail server always receives messages from e-mail clients that the user uses, or maybe from other e-mail servers. Web mail functions to send and view e-mail messages through a web browser. The squirrelmail configuration is done by running the conf.pl: $ / var / www / wemail / config / conf.pl script. Exchange Server services include: Directory Service, Simple Mail Transfer Protocol (SMTP), Post Office Protocol (POP3), IMAP (Internet Message Access Protocol), Complementary Services, System Attendants. For Mail Server Delivery Process can be seen in number5.2.

A Comprehensive Analysis of DDoS attacks based on DNS

Domain Name System (DNS) is a basic and important services on the Internet. However, Distributed Denial of Service (DDoS) has been a threat to the security and stability of DNS for a long time. In this paper, we take a review of DDoS attacks based on DNS aiming to make a better understanding of it. Firstly, we analyse the security vulnerabilities of DNS related to denial-of-service attack. Then we discuss the classification of DNS DDoS attacks, and divide them into four categories according to the attack mode. Finally, we summarize the existing defense methods of two aspects. We aim to get a better understanding of the DDoS attacks based on DNS and expand the understanding of DDoS attacks.

Standardizing Confidentiality Protections for Domain Name System Exchanges: Multiple Approaches, New Functionality

Confidentiality protections have become a major focus of standards development for the Domain Name System (DNS) protocol. DNS encryption techniques as well as alternative techniques with lower operational impact have both emerged. This article provides a high-level overview of these techniques and the considerations for applying them in various parts of the DNS ecosystem. The article also discusses how the standardization of DNS encryption can facilitate a new multi-resolver architecture where clients route queries to one or more special-purpose resolvers associated with enterprise or application namespaces.

IDC: Elevating Network Security with DNS

The Domain Name System (DNS) is critical to the functioning of the Internet. And yet it's one of the most under-protected parts of the infrastructure. Attacks against DNS services can achieve devastating effects, from redirecting traffic to malicious sites to making whole swathes of the Internet inaccessible.

Building a DNS Tunneling Dataset

Background: Domain Name System (DNS) is considered the phone book of the Internet. Its main goal is to translate a domain name to an IP address that the computer can understand. However, DNS can be vulnerable to various kinds of attacks, such as DNS poisoning attacks and DNS tunneling attacks. Objective: The main objective of this paper was to allow researchers to identify DNS tunnel traffic using machine-learning algorithms. Training machine-learning algorithms to detect DNS tunnel traffic and determine which protocol was used will help the community to speed up the process of detecting such attacks. Method: In this paper, we considered the DNS tunneling attack. In addition, we discussed how attackers can exploit this protocol to infiltrate data breaches from the network. The attack starts by encoding data inside the DNS queries to the outside of the network. The malicious DNS server will receive a small chunk of data decoding the payload and put it together at the server. The main concern is that the DNS is a fundamental service that is not usually blocked by a firewall and receives less attention from systems administrators due to a vast amount of traffic. Results: This paper investigates how this type of attack happens using the DNS tunneling tool by setting up an environment consisting of compromised DNS servers and compromised hosts with the Iodine tool installed in both machines. The generated dataset contains the traffic of HTTP, HTTPS, SSH, SFTP, and POP3 protocols over the DNS. No features were removed from the dataset so that researchers could utilize all features in the dataset. Conclusion: DNS tunneling remains a critical attack that needs more attention to address. DNS tunneled environment allows us to understand how such an attack happens. We built the appropriate dataset by simulating various attack scenarios using different protocols. The created dataset contains PCAP, JSON, and CSV files to allow researchers to use different methods to detect tunnel traffic.

Hybrid rule-based botnet detection approach using machine learning for analysing DNS traffic.

Botnets can simultaneously control millions of Internet-connected devices to launch damaging cyber-attacks that pose significant threats to the Internet. In a botnet, bot-masters communicate with the command and control server using various communication protocols. One of the widely used communication protocols is the ‘Domain Name System’ (DNS) service, an essential Internet service. Bot-masters utilise Domain Generation Algorithms (DGA) and fast-flux techniques to avoid static blacklists and reverse engineering while remaining flexible. However, botnet’s DNS communication generates anomalous DNS traffic throughout the botnet life cycle, and such anomaly is considered an indicator of DNS-based botnets presence in the network. Despite several approaches proposed to detect botnets based on DNS traffic analysis; however, the problem still exists and is challenging due to several reasons, such as not considering significant features and rules that contribute to the detection of DNS-based botnet. Therefore, this paper examines the abnormality of DNS traffic during the botnet lifecycle to extract significant enriched features. These features are further analysed using two machine learning algorithms. The union of the output of two algorithms proposes a novel hybrid rule detection model approach. Two benchmark datasets are used to evaluate the performance of the proposed approach in terms of detection accuracy and false-positive rate. The experimental results show that the proposed approach has a 99.96% accuracy and a 1.6% false-positive rate, outperforming other state-of-the-art DNS-based botnet detection approaches.

Oblivious DNS over HTTPS (ODoH): A Practical Privacy Enhancement to DNS

Abstract The Internet’s Domain Name System (DNS) responds to client hostname queries with corresponding IP addresses and records. Traditional DNS is unencrypted and leaks user information to on-lookers. Recent efforts to secure DNS using DNS over TLS (DoT) and DNS over HTTPS (DoH) have been gaining traction, ostensibly protecting DNS messages from third parties. However, the small number of available public large-scale DoT and DoH resolvers has reinforced DNS privacy concerns, specifically that DNS operators could use query contents and client IP addresses to link activities with identities. Oblivious DNS over HTTPS (ODoH) safeguards against these problems. In this paper we implement and deploy interoperable instantiations of the protocol, construct a corresponding formal model and analysis, and evaluate the protocols’ performance with wide-scale measurements. Results suggest that ODoH is a practical privacy-enhancing replacement for DNS.

A comprehensive survey on DNS tunnel detection

Domain Name System (DNS) tunnels, established between the controlled host and master server disguised as the authoritative domain name server, can be used as a secret data communication channel for malicious activities. Owing to the ready evasion of the DNS traffic to bypass the network security mechanism, DNS tunnelling can cause severe damage. Thus, an in-depth and comprehensive understanding of the various detection technologies is of considerable importance when facing this type of threat. However, most of the existing reviews focus on a single aspect of the DNS tunnel detection technologies, such as methods based on machine learning, traffic, and payload analysis. In addition, few studies have conducted comprehensive investigation that includes a sequentially integrated range of literature in this researchfield, or have analysed the latest literature on DNS tunnels. This paper reviews these detection technologies from a novel perspective of rule-based and model-based methods with descriptions and analyses of the DNS-based tools and their corresponding features. To the best of our knowledge, this is the first study to comprehensively discuss and analyse DNS tunnel detection in a novel and specific classification fashion from various aspects in detail, covering almost all the detection methods developed from 2006 to 2020. Furthermore, a comparative analysis of detection methods and several suggestions for future research directions are presented.

Research on Addressing Technology of Internet of Things Unique Resources Based on RFID

The global nature of the Internet of things obviously has the problem of cross domain communication, so the Internet of things also needs a set of perfect resource addressing technology to meet its resource addressing needs and promote the interconnection of the Internet of things. Through the analysis of five key elements of resource addressing, such as resource name, resource address, addressing mechanism, update mechanism and security mechanism, this paper summarizes the resource addressing characteristics of Internet of things, which is not only conducive to the design of resource addressing model of Internet of things that meets the demand of resource addressing, but also the necessary premise to solve the key technology of resource addressing of Internet of things. In order to solve the address conflict and addressing problem between different standards of radio frequency identification (RFID), a hierarchical addressing model based on RFID resource name space is proposed. This paper analyzes the characteristics of RFID resource addressing and the existing RFID addressing technology, finds out the defects of addressing technology based on domain name system, introduces the formal expression method of RFID resource namespace, and designs a hierarchical addressing model.

Malware on Internet of UAVs Detection Combining String Matching and Fourier Transformation

Advanced persistent threat (APT), with intense penetration, long duration, and high customization, has become one of the most grievous threats to cybersecurity. Furthermore, the design and development of Internet-of-Things (IoT) devices often do not focus on security, leading APT to extend to IoT, such as the Internet of emerging unmanned aerial vehicles (UAVs). Whether malware with attack payload can be successfully implanted into UAVs or not is the key to APT on the Internet of UAVs. APT malware on UAVs establishes communication with the command and control (C&C) server to achieve remote control for UAVs-aware information stealing. Existing effective methods detect malware by analyzing malicious behaviors generated during C&C communication. However, APT malware usually adopts a low-traffic attack mode, a large amount of normal traffic is mixed in each attack step, to avoid virus checking and killing. Therefore, it is difficult for traditional malware detection methods to discover APT malware on UAVs that carry weak abnormal signals. Fortunately, we found that most APT attacks use domain name system (DNS) to locate C&C server of malware for information transmission periodically. This behavior will leave some records in the network flow and DNS logs, which provides us with an opportunity to identify infected internal UAVs and external malicious domain names. This article proposes an APT malware on the Internet of UAVs detection method combining string matching and Fourier transformation based on DNS traffic, which is able to handle encrypted and obfuscated traffic due to packet payloads independence. We preprocessed the collected network traffic by converting DNS timestamps of DNS request to strings and used the trained random forest model to discover APT malware domain names based on features extracted through string-matching-based periodicity detection and Fourier transformation-based periodicity detection. The proposed method has been evaluated on the data set, including part of normal domains from the normal traffic and malicious domains marked by security experts from APT malware traffic. Experimental results have shown that our proposed detection method can achieve the accuracy of 94%, which is better than the periodicity detection algorithm alone. Moreover, the proposed method does not need to set the confidence to filter the periodicity with high confidence.

Toward Domain Name System privacy enhancement using intent‐based Moving Target Defense framework over software defined networks

AbstractMoving Target Defense (MTD) is an active security procedure while intent‐based networking (IBN) is gaining popularity as an evolving networking model. Software defined network (SDN) provides centralized network management through the control plane. In this article, a mechanism for the privacy enhancement of the Domain Name System (DNS) is proposed using intent‐based MTD over SDN. DNS is a critical internet service with a high risk of privacy disclosure as it is related to user preferences. The proposed model privacy enhancement using intent‐based MTD running over SDN (PEIMS) exploits IBN API of ONOS SDN controller along with Openflow flow modification for privacy enhancement. PEIMS core components include MTD application running over the ONOS SDN controller, ONOS intent‐based API, and the DNS server. The notion is the protection of privacy disclosures that occur during DNS queries. PEIMS provides a dynamic port shuffling technique for mapping DNS traffic to minimize the attacker's chances of observing the DNS queries responses. The proposed model was implemented using ONOS controller, ONOS north bound intent‐based API, and Mininet. The proposed model was evaluated in terms of privacy protection, attacker, and defender cost. The results showed promising trends for DNS privacy protection at a low computational cost. The work also quantified the privacy disclosures.

DNS Tunneling Detection by Cache-Property-Aware Features

Many enterprises are under threat of targeted attacks aiming at data exfiltration. To launch such attacks, in recent years, attackers with their malware have exploited a covert channel that abuses the domain name system (DNS) named DNS tunneling. Although several research efforts have been made to detect DNS tunneling, the existing methods rely on features that advanced tunneling techniques can easily obfuscate by mimicking legitimate DNS clients. Such obfuscation would result in data leakage. To tackle this problem, we focused on a “trace” left by DNS tunneling that cannot be easily hidden. In the context of data exfiltration by DNS tunneling, the malware connects directly to the DNS cache server and the generated DNS tunneling queries produce cache misses with absolute certainty. In this study, we propose a DNS tunneling detection method based on the cache-property-aware features. Our experiments show that one of the proposed features can efficiently characterize the DNS tunneling traffic. Furthermore, we introduce a rule-based filter and a long short-term memory (LSTM)-based filter using this proposed feature. The rule-based filter achieves a higher rate of DNS tunneling attack detection than the LSTM one, which instead detects the attack more quickly, while both maintain a low misdetection rate.

DNSxP: Enhancing data exfiltration protection through data plane programmability

According to a 2019 Radware report, guarding sensitive data is the highest priority area for investment in cyber security. This is no surprise given the high number of reported data breach incidents annually, and the implication of these on the individuals or organisations targeted. Data exfiltration is a key stage in this form of cyber-attack, and the use of the Domain Name System protocol for data exfiltration is popular due to the essential nature of the protocol for network communication. This paper presents a DNS data exfiltration Protection (DNSxP) security architecture leveraging Software-Defined Networking and Data Plane Programmability. The solution is developed based on analysis of different malicious use cases for transmitting data over the DNS protocol. By performing coarse-grained packet filtering and analysis in the data plane, clear benign or malicious traffic can be identified quickly, while suspicious traffic is passed to additional security controls at the SDN controller for classification. As the results demonstrate, this approach offers the combined benefit of reducing data loss during an exfiltration attack and reducing network resource consumption.

Research on Unexpected DNS Response from Open DNS Resolvers

Abstract As the backbone of the domain name system (DNS), DNS resolvers are essential to the Internet. Nowadays, the measurement of DNS resolvers, especially open DNS resolvers, has become a research focus. Previous research works show that DNS responses returned from some open DNS resolvers are not expected for clients and the Internet. We call these DNS responses ‘unexpected DNS responses’. Research on unexpected DNS responses is beneficial to the research, usage and management of open DNS resolvers. This paper explores unexpected DNS responses returned from open DNS resolvers in terms of identification and classification to better understand the behaviours of open DNS resolvers. First, an identification method is proposed to identify all kinds of DNS responses from each section of DNS messages. Second, a classification method is proposed to classify unexpected DNS responses by their influences on clients and the Internet. Furthermore, an efficient identification and classification method is proposed to simplify the above process. Among about 9 million responding open DNS resolvers in the experiments on the IPv4 address space, about 40% return unexpected DNS responses. Experimental results show that the proposed methods can identify and classify all kinds of DNS responses returned from open DNS resolvers.

The Role of Blockchain in Cyber Security

Cyber security breaches are on the rise globally. Due to the introduction of legislation like the EU’s General Data Protection Regulation (GDPR),companies are now subject to further financial penalties if they fail to meet requirements in protecting user information. In 2018, 75% of CEOs and board members considered cyber security and technology acquisitions among their top priorities, and blockchain based solutions were among the most considered options. Blockchain is a decentralised structure that offers multiple security benefits over traditional, centralised network architectures. These two approaches are compared in this chapter in areas such as data storage, the Internet of Things (IoT) and Domain Name System (DNS) in order to determine blockchain’s potential in the future of cyber security

Entropy-Based Evaluation of DNS Activity for Threat Hunting

The paper documents, based mainly on published papers where a consistent mathematical description of cyberspace and various types of Cyber-Attacks and protection measures are presented, a mathematical approach for Cyber Threat Hunting using Domain Name System (DNS) observations. After referring to the various Advanced Persistent Threat (APT) hunting techniques we propose a high level, mainly, entropy-based technique for detecting the existence of various threat vectors in our networks, demystifying DNS Anomalies. Keywords: Domain Name System (DNS), Advanced Persistent Threat (APT) actors, Entropy, Anomaly Detection.

Micro-grid Monitoring and Supervision: Web-based SCADA Approach

Owing to the widespread use of the micro-grid concept to serve many real life applications, the main concern of this paper is to monitor, evaluate and manage the operational performance of an existent, already installed micro-grid that consists of On & Off grid PV systems in addition to the main grid supply. With the aid of customized web based SCADA system fully designed by authors, the performance evaluation of the proposed micro-grid is carried out in terms of energy consumption, power quality indices and energy cost based on Egypt’s energy current tariff. The designed system helps in both micro-grid status monitoring as well as load sharing between the main grid supply and the off grid PV energy system. The data of the on grid PV energy system are accessed and collected online directly from the inverter web server instead of downloading them offline from the PV inverter. In this case, data are analyzed with a reasonable refresh rate, which saves time and effort. Remote access platform is developed securely through a multi-level security authentication and strong data encryption using the OpenVPN protocol under the Dynamic Domain Name System service. Smart wired and wireless technology—used as integrated sensing devices to the developed SCADA system—enables easy system installation and running cost saving. Finally, to validate the collected data from the newly SCADA designed monitoring system, a performance characterization for the on grid PV system following international standards of yields calculations is carried out for 3 months in 2019.

Big Data Architecture for Scalable and Trustful DNS based on Sharded DAG Blockchain

Internet applications remain exposed to pervasive Domain Name System (DNS)–based threats. Blockchain technologies provide a new way for tackling DNS vulnerability issues, and have been highlighted recently. However, traditional blockchain is still not well suited for big data applications such as DNS, because the performance of blockchain consensus greatly limits its practical adoption. In this paper, we present DagGridLedger, a sharded directed acyclic graph (DAG) blockchain that provides scalable big data architecture for trustful DNS management. To achieve this goal, DagGridLedger proposes a radical new architecture that combines blockchain sharding and DAG techniques on the DNS resolver side, thereby making it a promising solution to enhance the security and stability of large-scale DNS system. To be specific, DagGridLedger provides a blockchain structure targeting DNS application, which employs a high-performance DAG consensus algorithm named DagGrid. DagGrid consensus realizes a multi-DNS negotiation mechanism through block sharding in generating a block. With an improved asynchronous leaderless Byzantine consensus, DagGrid implements total order determination, which guarantees the trustful DNS management. Further experiments verified the performance of DagGridLedger as well as the applicability of the proposed blockchain architecture in traditional DNS. To this end, DagGridLedger consistently achieves a big data architecture for secure DNS record management, with a novel shared DAG consensus designed for high throughput. This makes DagGridLedger a promising architecture for highly secure and efficient DNS solution.

An intelligent algorithmically generated domain detection system

This paper proposes an intelligent system, called IDGADS, for detecting algorithmically generated domains in the early stages based on easy and automatic computable features of real domain name system (DNS) traffic quickly without investing time in reverse engineering and/or log monitoring or dependency on external information like WHOIS/DNS response. IDGADS is a supervised deep learning model, trained over 17M domains from the reputed sources. It is implemented in Python and served as a service over the cloud for free testing of the public in the form of a web app. IDGADS is capable of detecting malicious domains up to 99% accuracy. Till 17-April-2020, 1160963 domains have been tested, and it has detected 817069 DGA-generated domains by the users of different countries. Since IDGADS is developed to check DNS queries only, thus it can be installed as the first line of defence in security stack for validating DNS queries before sending to DNS server.

B-DNS: A Secure and Efficient DNS Based on the Blockchain Technology

The Domain Name System (DNS) plays a crucial role in the Internet. However, it is vulnerable to many attacks such as the cache poisoning attack and DDoS attack. Though some countermeasures have been proposed, they still have some limitations. In this paper, we propose B-DNS, a blockchain-based domain name system, which can provide a secure and efficient DNS service. B-DNS fills up two shortcomings of current blockchain-based DNS, namely computation-heavy Proof-of-Work (PoW) protocol and inefficient query, by building a Proof-of-Stake (PoS) consensus protocol and an index of domains. We propose a novel way to quantitatively compare the security of B-DNS and legacy DNS in terms of attack success rate, attack cost, and attack surface. Our experiments show that the probability of a successful attack on B-DNS is 1% of a successful attack on legacy DNS, the attack cost goes up a million times in B-DNS, and the attack surface of B-DNS is far smaller than that of legacy DNS. The query performance evaluation of B-DNS shows that B-DNS can achieve similar or even less query latency than state-of-the-art commercial DNS implementations.