DNSSM: A Large Scale Passive DNS Security Monitoring Framework - - PowerPoint PPT Presentation

▶

Jan 05, 2023 37 likes •218 views

samuel.marchal@uni.lu 16/04/12 DNSSM: A Large Scale Passive DNS Security Monitoring Framework Samuel Marchal, J er ome Fran cois, Cynthia Wagner, Radu State, Alexandre Dulaunoy, Thomas Engel, Olivier Festor Motivation Solution

SLIDE 1

samuel.marchal@uni.lu 16/04/12

DNSSM: A Large Scale Passive DNS Security Monitoring Framework

Samuel Marchal, J´ erˆ

me Fran¸

cois, Cynthia Wagner, Radu State, Alexandre Dulaunoy, Thomas Engel, Olivier Festor

SLIDE 2

Motivation Solution Experiments and Results Conclusion

Outline

1 Motivation 2 Solution 3 Experiments and Results 4 Conclusion

2 / 18

SLIDE 3

Motivation Solution Experiments and Results Conclusion

Outline

1 Motivation 2 Solution 3 Experiments and Results 4 Conclusion

3 / 18

SLIDE 4

Motivation Solution Experiments and Results Conclusion

Overview of DNS

◮ DNS (Domain Name System) is the service that maps

a domain name to its associated IP addresses www.example.com = ⇒ 123.45.6.78

◮ DNS is the service that allows to find information

about a domain :

◮ A : IPv4 address ◮ AAAA : IPv6 address ◮ MX : Mail server ◮ NS : Authoritative DNS server ◮ TXT : any information

4 / 18

SLIDE 5

Motivation Solution Experiments and Results Conclusion

Why DNS monitoring ?

◮ DNS:

◮ critical Internet service ◮ threats: cache poisoning, typosquatting, DNS tunnelling,

fast/double-flux ⇒ enhance: phishing, botnet C&C communications, covered channel communications etc.

⇒ Patterns in DNS packet fields and DNS querying behavior

◮ Passive DNS monitoring to detect:

◮ worm infected hosts ◮ malicious backdoor communication ◮ botnet participating hosts ◮ phishing websites hosting

5 / 18

SLIDE 6

Motivation Solution Experiments and Results Conclusion

Existing solutions

◮ Mainly use supervised classification techniques

◮ SVM, tree, rules, etc. ◮ require malicious data for training

◮ Targeted identification of malicious domains

◮ C&C communication involved domains ◮ Phishing domains ◮ Spamming domains ◮ etc.

6 / 18

SLIDE 7

Motivation Solution Experiments and Results Conclusion

Outline

1 Motivation 2 Solution 3 Experiments and Results 4 Conclusion

7 / 18

SLIDE 8

Motivation Solution Experiments and Results Conclusion

Clustering

Automated clustering technique for online analysis

◮ No previous knowledge ◮ Group domains regarding their activity ◮ DNS information ⇒ Domain activity ◮ Disclose the raise of new threats ◮ K-means clustering ◮ 10 relevant features

8 / 18

SLIDE 9

Motivation Solution Experiments and Results Conclusion

Features

For each domain observed:

◮ Number of IP addresses ◮ IP scattering : entropy based and position weighted ◮ mean TTL ◮ Requests count ◮ Period of observation ◮ Requests per hour ◮ Name servers count ◮ Number of subdomains ◮ Blacklisted flag

9 / 18

SLIDE 10

Motivation Solution Experiments and Results Conclusion

User interface

DNSSM is an approach for automated analysis of DNS (passive traffic)

◮ Manual assistance in tracking anomalies:

◮ Feed with cap file ◮ All DNS packet fields extracted ◮ MySQL database storage model ◮ Web interface ◮ Fast and efficient mining functions ◮ Integrates with existing blacklist tools to assist in tagging

data

◮ Detection of fast/double flux domains, DNS tunnelling, etc. ◮ Freely downloadable at:

https://gforge.inria.fr/\docman/view.php/3526/ 7602/kit_dns_anomalies.tar.gz

10 / 18

SLIDE 11

Motivation Solution Experiments and Results Conclusion

Architecture

11 / 18

SLIDE 12

Motivation Solution Experiments and Results Conclusion

Outline

1 Motivation 2 Solution 3 Experiments and Results 4 Conclusion

12 / 18

SLIDE 13

Motivation Solution Experiments and Results Conclusion

Experiments

◮ 2 datasets (= location, = type of network, = users, = quantity) ◮ Automatic results from k-means: 8 clusters exhibiting different

properties

◮ Cluster 5: apple.com, amazon.fr, adobe.com(highly popular

websites)

13 / 18

SLIDE 14

Motivation Solution Experiments and Results Conclusion

Results

◮ Cluster 6: google.com. skype.com, facebook.com (higly popular

web sites)

◮ Cluster 7: tradedoubler.com, doubleclick.net, quantcast.com

(user tracking)

◮ Cluster 3: akamai, cloudfront.net (CDN)

14 / 18

SLIDE 15

Motivation Solution Experiments and Results Conclusion

Results

◮ Cluster 0: small websites with low popularity

15 / 18

SLIDE 16

Motivation Solution Experiments and Results Conclusion

Outline

1 Motivation 2 Solution 3 Experiments and Results 4 Conclusion

16 / 18

SLIDE 17

Motivation Solution Experiments and Results Conclusion

Conclusion

◮ Passive DNS monitoring solution

◮ Analysis of domain names activity ◮ Relevant data mining algorithm (unsupervised clustering

techniques)

◮ Efficiency proved on two different datasets ◮ Freely downloadable interface

◮ Applications:

◮ Investigate cyber security fraud ◮ Debug DNS deployment ◮ Penetration testing

17 / 18

SLIDE 18

samuel.marchal@uni.lu 16/04/12

DNSSM: A Large Scale Passive DNS Security Monitoring Framework

Samuel Marchal, J´ erˆ

me Fran¸