Resource Record Research Articles

Detecting Network Scanning Through Monitoring and Manipulation of DNS Traffic

In this paper, we propose an approach for detecting internal and external network scanning attacks on enterprise networks. In our approach, an inline scan detection system (SDS) monitors the ingress and egress flows of an enterprise network subnet and detects scanning probes based on the correlation of flows with preceding DNS query/responses and reducing TTL values of DNS Resource Records (RR). Through rigorous evaluation, we show that our method is effective against both external and internal port scanners and network worms, its effectiveness is independent of scanning rate or technique, and its deployment incurs negligible overhead on DNS and network response times. While the idea of detecting scans by correlating network flows with preceding DNS query/responses has been proposed in the literature, this work extends the state-of-the-art by offering four contributions: 1) we show that without decreasing TTL values of RRs in DNS responses, attackers can piggyback on cached DNS records to bypass our detection; thus we incorporate a TTL reduction mechanism to enhance the effectiveness of this approach, especially against stealthy and adaptive scanners; 2) while prior works work against internal scanners, we use the relatively new extension of DNS protocol, ENDS0 Client Subnet (ECS) option, to expand this approach toward detecting external scanners; 3) we present a novel adaptive scanning technique, called DNS-cache-based scanning, that exploits local DNS cache to bypass prior detection methods, and shows that, while prior approaches fail to defeat this threat model, our approach is effective against this evolved threat model as well; and 4) contrary to existing work that focuses on defeating fast network scanning worms, this approach is effective against any scanning, including stealthy scanning that uses conservative timing profiles to evade detection.

An Exploration of the Adoption of DNSSEC by Businesses within the Norwegian ccTLD

The Domain Name System Security Extension (DNSSEC) is a cryptographic extension to the Domain Name System (DNS). The DNSSEC gives the DNS hierarchy a chain of trust from the root zone all the way down to the domain. By utilising DNSSEC, the client can verify that the DNS server’s response has not been tampered with in transit using strong trustworthy cryptographic algorithms. This paper presents a pilot research into the adoption of DNSSEC in Norwegian (.NO) ccTLD. The data set investigated in this researched a collection of Norwegian businesses that have a domain within the Norwegian ccTLD. This research found out that the Norwegian ccTLD adoption rate is amongst one of the highest compared to other ccTLDs. The DNSKEY resource records (RRs) collected in this research were used to identify some potential weaknesses. These possible weaknesses include the algorithm used, how long validity there was on the DNSKEY, and shared DNSKEY values across multiple domains.

Measuring DNS over TCP in the era of increasing DNS response sizes

The Domain Name System (DNS) is one of the most crucial parts of the Internet. Although the original standard defined the usage of DNS over UDP (DoUDP) as well as DNS over TCP (DoTCP), UDP has become the predominant protocol used in the DNS. With the introduction of new Resource Records (RRs), the sizes of DNS responses have increased considerably. Since this can lead to truncation or IP fragmentation , the fallback to DoTCP as required by the standard ensures successful DNS responses by overcoming the size limitations of DoUDP. However, the effects of the usage of DoTCP by stub resolvers are not extensively studied to this date. We close this gap by presenting a view at DoTCP from the Edge, issuing 12.1M DNS requests from 2,500 probes toward Public as well as Probe DNS recursive resolvers. In our measurement study, we observe that DoTCP is generally slower than DoUDP, where the relative increase in Response Time is less than 37% for most resolvers. While optimizations to DoTCP can be leveraged to further reduce the response times, we show that support on Public resolvers is still missing, hence leaving room for optimizations in the future. Moreover, we also find that Public resolvers generally have comparable reliability for DoTCP and DoUDP. However, Probe resolvers show a significantly different behavior: DoTCP queries targeting Probe resolvers fail in 3 out of 4 cases, and, therefore, do not comply with the standard. This problem will only aggravate in the future: As DNS response sizes will continue to grow, the need for DoTCP will solidify.

An Osmotic Computing Enabled Domain Naming System (OCE-DNS) for distributed service relocation between cloud and edge

Osmotic computing has emerged as a solution enabling the Cloud–Edge–Internet of Things (IoT) continuum. It supports the transparent deployment of distributed services called Micro ELements (MELs) over these heterogeneous software layers guaranteeing application proximity to end-users. This paradigm is very useful for data mining processing of emerging future Internet applications because it allows optimizing both the response time and the usage of computational resources. In this paper, we focus on an approach for identifying MELs which serve a specific geographical area. In particular, we present the Osmotic Computing Enabled Domain Name System (OCE-DNS), an advanced DNS able to reference MELs using the Extended Plus Codes, a three dimensional geocode algorithm defined by us. Experiments show that OCE-DNS guarantees quick Resource Records (RR) readings and updates, thence supporting the management of transparent Osmotic MEL migrations.

Software-defined Naming, Discovery and Session Control for IoT Devices and Smart Phones in the Constraint Networks

This paper suggests the naming for Internet of Things (IoT) devices where a Fully Qualified Domain Name (FQDN) is assigned to each device instead of the IP address. This naming method enables the user equipments (UEs) to reach IoT devices easily. Nowadays, one of the main challenges in IoT is the discovery scheme. This paper explores the discovery scheme that can operate under the current DNS and its legacy Resource Record (RR) format. The IoT device with the group name of GrpN, the domain of example.com and the device name of IoT77 can be discovered by means of the URL: GrpN.example.com/IoTD77. This paper explores how the UE behind the Network Address Translation (NAT) device discovers the destination IoT devices and establishes IoT Device-to-User Equipment (D2U) data session under the condition that IoT access networks tend to be constraint networks. Here, the discovery and session establishment processes are controlled by the software-defined control plane controller.

DNS ANY Request Cannon Activity in DNS Query Packet Traffic

We statistically investigated the total ANY resource record (RR) based DNS query request packet traffic from the Internet to the top domain DNS server in a university campus network through January 1st, 2011 to December 31st, 2012. The obtained results are: (1) We found a significant increase in the inbound ANY RR based DNS query request traffic at November 28th, 2011. (2) In the DNS query request packet traffic, we observed only a query keyword of the campus domain name. (3) We found a correlation between the total inbound DNS query request packet traffic and the DNS query request packet traffic including the query keyword. (4) Also, we carried out the loading test sending ANY, A, and PTR RR unique DNS queries to a test DNS server, we observed no difference among the vmstat parameters, and the load value was 0.10-0.20. These results indicate that the ANY RR based DNS request packet traffic is quite strange. However, it should be meaningless activity.

Adaptive TTL based Approach to Balance DNS Server Load

This paper presents analysis of Domain Name System (DNS) resource records (RR) “time-to-live” (TTL) values at authoritative DNS server to balance DNS query rate at the desired level. According to the research and experiment results adaptive TTL value can be effectively used to manipulate incoming DNS query rate. Ill. 5, bibl. 11 (in English; abstracts in English and Lithuanian).DOI: http://dx.doi.org/10.5755/j01.eee.117.1.1058

Evaluation of DNS Based SSH Dictionary Attack Traffic in Campus Network

We performed statistical analysis on the total PTR resource record (RR) based DNS query packet traffic from a university campus network to the top domain DNS server through March 14th, 2009, when the network servers in the campus network were under inbound SSH dictionary attack. The interesting results are obtained, as follows: (1) the network servers, especially those providing SSH services, generated the significant PTR RR based DNS query request packet traffic through 07:30-08:30 in March 14th, 2009, (2) we calculated sample variance for the DNS query request packet traffic, (3) the variance can change in a sharp manner through 07:30-08:30, (4) we developed a couple of DNS based SSH detection technologies by employing the PTR RR DNS query request packet traffic variance- and the DNS query keywords Euclid distance based methods, and (5) we evaluated and compared the both detection rates. As a result, although the both detection technologies take high detection rates, the Euclid distance based detection technology can take a low false positive rate than that of the variance based one, indicating that we can detect the inbound SSH dictionary attack to the network server in the campus network by observing the total PTR RR DNS query request packet traffic from the campus network.

Detection of NS Resource Record DNS Resolution Traffic, Host Search, and SSH Dictionary Attack Activities

We carried out an entropy study on the DNS query traffic from the Internet to the top domain DNS server in a university campus network through January 1st to March 31st, 2009. The obtained results are: (1) We observed a difference for the entropy changes among the total-, the A-, and the PTR resource records (RRs) based DNS query traffic from the Internet through January 17th to February 1st, 2009. (2) We found the large NS RR based DNS query traffic including only a keyword . in the total inbound DNS query traffic. (3) We also found that the unique source IP address based PTR DNS traffic entropy slightly increased, while the unique DNS query keywords based one drastically decreased in March 9th, 2009. We found a specific IP host which was an already-hijacked classical Linux PC that carried out the SSH dictionary attack to the Internet sites in March 9th, 2009. From these results,we can detect the unusual inbound NS RR based DNS traffic and the outbound SSH dictionary attacks by only watching DNS query traffic from the Internet.

Variant Chinese Domain Name Resolution

Many efforts in past years have been made to lower the linguistic barriers for non-native English speakers to access the Internet. Internet standard RFC 3490, referred to as IDNA (Internationalizing Domain Names in Applications), focuses on access to IDNs (Internationalized Domain Names) in a range of scripts that is broader in scope than the original ASCII. However, the use of character variants that have similar appearances and/or interpretations could create confusion. A variant IDL (Internationalized Domain Label), derived from an IDL by replacing some characters with their variants, should match the original IDL; and thus a variant IDN does. In RFC 3743, referred to as JET (Joint Engineering Team) Guidelines, it is suggested that zone administrators model this concept of equivalence as an atomic IDL package. When an IDL is registered, an IDL package is created that contains its variant IDLs generated according to the zone-specific Language Variant Tables (LVTs). In addition to the registered IDL, the name holder can request the domain registry to activate some of the variant IDLs, free or by an extra fee. The activated variant IDLs are stored in the zone files, and thus become resolvable. However, an issue of scalability arises when there is a large number of variant IDLs to be activated. In this article, the authors present a resolution protocol that resolves the variant IDLs into the registered IDL, specifically for Han character variants. Two Han characters are said to be variants of each other if they have the same meaning and are pronounced the same. Furthermore, Han character variants usually have similar appearances. It is not uncommon that a Chinese IDL has a large number of variant IDLs. The proposed protocol introduces a new RR (resource record) type, denoted as VarIdx RR, to associate a variant expression of the variant IDLs with the registered IDL. The label of the VarIdx RR, denoted as the variant index, is assigned by an indexing function that is designed to give the same value to all of the variant IDLs enumerated by the variant expression. When one of the variant IDLs is accessed, Internet applications can compute the variant index, look up the VarIdx RRs, and resolve the variant IDL into the registered IDL. The authors examine two sets of Chinese IDLs registered in TWNIC and CNNIC, respectively. The results show that for a registered Chinese IDL, a very small number of VarIdx RRs, usually one or two, are sufficient to activate all of its variant IDLs. The authors also represent a Web redirection service that employs the proposed resolution protocol to redirect a URL addressed by a variant IDN to the URL addressed by the registered IDN. The experiment results show that the proposed protocol successfully resolves the variant IDNs into the registered IDNs.