TY - GEN
T1 - Anomaly detection for DNS servers using frequent host selection
AU - Yamada, Akira
AU - Miyake, Yutaka
AU - Terabe, Masahiro
AU - Hashimoto, Kazuo
AU - Kato, Nei
PY - 2009/10/5
Y1 - 2009/10/5
N2 - DNS is one of the internet's fundamental building blocks, used by various applications such as web and mail transfer. Therefore, monitoring DNS traffic has potential to detect host anomalies such as spammers and infected hosts in a network. However, previous works assume a small number of hosts or target on domain name anomalies, so that they cannot be applied to a large-scale networks due to performance issues. A large number of hosts and long-term tracing consume computational resources and make realtime analysis difficult. In this paper, we propose anomaly detection for DNS servers using frequent host selection, which selects only potential hosts and does not depend on the number of hosts. We evaluate the proposed system using DNS traffic for 6 months of tracing, and show that the system can feasibly handle hosts in the dataset and detect anomalies, such as mail servers suffering from spam and DNS servers are configured incorrectly.
AB - DNS is one of the internet's fundamental building blocks, used by various applications such as web and mail transfer. Therefore, monitoring DNS traffic has potential to detect host anomalies such as spammers and infected hosts in a network. However, previous works assume a small number of hosts or target on domain name anomalies, so that they cannot be applied to a large-scale networks due to performance issues. A large number of hosts and long-term tracing consume computational resources and make realtime analysis difficult. In this paper, we propose anomaly detection for DNS servers using frequent host selection, which selects only potential hosts and does not depend on the number of hosts. We evaluate the proposed system using DNS traffic for 6 months of tracing, and show that the system can feasibly handle hosts in the dataset and detect anomalies, such as mail servers suffering from spam and DNS servers are configured incorrectly.
UR - http://www.scopus.com/inward/record.url?scp=70349508910&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=70349508910&partnerID=8YFLogxK
U2 - 10.1109/AINA.2009.93
DO - 10.1109/AINA.2009.93
M3 - Conference contribution
AN - SCOPUS:70349508910
SN - 9780769536385
T3 - Proceedings - International Conference on Advanced Information Networking and Applications, AINA
SP - 853
EP - 860
BT - Proceedings - 2009 International Conference on Advanced Information Networking and Applications, AINA 2009
T2 - 2009 International Conference on Advanced Information Networking and Applications, AINA 2009
Y2 - 26 May 2009 through 29 May 2009
ER -