Anomaly detection for DNS servers using frequent host selection

Akira Yamada, Yutaka Miyake, Masahiro Terabe, Kazuo Hashimoto, Nei Kato

Research output: Chapter in Book/Report/Conference proceedingConference contribution

5 Citations (Scopus)

Abstract

DNS is one of the internet's fundamental building blocks, used by various applications such as web and mail transfer. Therefore, monitoring DNS traffic has potential to detect host anomalies such as spammers and infected hosts in a network. However, previous works assume a small number of hosts or target on domain name anomalies, so that they cannot be applied to a large-scale networks due to performance issues. A large number of hosts and long-term tracing consume computational resources and make realtime analysis difficult. In this paper, we propose anomaly detection for DNS servers using frequent host selection, which selects only potential hosts and does not depend on the number of hosts. We evaluate the proposed system using DNS traffic for 6 months of tracing, and show that the system can feasibly handle hosts in the dataset and detect anomalies, such as mail servers suffering from spam and DNS servers are configured incorrectly.

Original languageEnglish
Title of host publicationProceedings - 2009 International Conference on Advanced Information Networking and Applications, AINA 2009
Pages853-860
Number of pages8
DOIs
Publication statusPublished - 2009 Oct 5
Event2009 International Conference on Advanced Information Networking and Applications, AINA 2009 - Bradford, United Kingdom
Duration: 2009 May 262009 May 29

Publication series

NameProceedings - International Conference on Advanced Information Networking and Applications, AINA
ISSN (Print)1550-445X

Conference

Conference2009 International Conference on Advanced Information Networking and Applications, AINA 2009
CountryUnited Kingdom
CityBradford
Period09/5/2609/5/29

ASJC Scopus subject areas

  • Engineering(all)

Fingerprint Dive into the research topics of 'Anomaly detection for DNS servers using frequent host selection'. Together they form a unique fingerprint.

  • Cite this

    Yamada, A., Miyake, Y., Terabe, M., Hashimoto, K., & Kato, N. (2009). Anomaly detection for DNS servers using frequent host selection. In Proceedings - 2009 International Conference on Advanced Information Networking and Applications, AINA 2009 (pp. 853-860). [5076288] (Proceedings - International Conference on Advanced Information Networking and Applications, AINA). https://doi.org/10.1109/AINA.2009.93