Characterizing dark DNS behavior

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volumn 4579 LNCS, Issue , 2007, Pages 140-156

  Oberheide, Jon ^a   Karir, Manish ^b   Mao, Z Morley ^a  

^a UNIVERSITY OF MICHIGAN   (United States)

^b Merit Network Inc   (United States)

Author keywords

Darknets; DNS; Honeypots; Reconnaissance; Sensors

Indexed keywords

COMPUTER CRIME; INFORMATION DISSEMINATION; INTERNET; SENSORS;

DARKNETS; HONEYPOTS; NETWORK OPERATORS; RECONNAISSANCE;

SECURITY OF DATA;

EID: 37849009457     PISSN: 03029743     EISSN: 16113349     Source Type: Book Series    
DOI: 10.1007/978-3-540-73614-1_9     Document Type: Conference Paper

References (21)

1. Mockapetris, P.: RFC 1034: Domain names: concepts and facilities (November 1987), ftp://ftp.internic.net/rfc/rfc1034.txt
2. Mockapetris, P.: RFC 1035: Domain names: implementation and specification (November 1987), ftp://ftp.internic.net/rfc/rfc1035.txt
3. Bellovin, S.: Using the domain name system for system break-ins. In: Proceedings of the 5th USENIX UNIX Security Symposium (1995)
4. Samwalla, R., Sharma, R., Keshav, S.: Discovering Internet Topology. Unpublished manuscript
5. Silveira, A.: TXDNS: an aggressive multithreaded DNS digger, http://www.txdns.net/.
6. Ishibashi, K., Toyono, T., Toyama, K., Ishino, M.: Detecting mass-mailing worm infected hosts by mining DNS traffic data. In: Proceedings of the Special Interest Group on Data Communications (SIGCOMM) (2005)
7. Kristoff, J.: Botnets, detection and mitigation: DNS-based techniques. NU Security Day (2005)
8. Schonewille, A., van Helmond, D.-J.: The Domain Name Service as an IDS: How DNS can be used for detecting and monitoring badware in a network (February 2006), http://staff.science.uva.nl/delaat/snb-2005-2006/p12/report.pdf
9. Whyte, D., Kranakis, E., Van Oorschot, P.: DNS-based Detection of Scanning Worms in an Enterprise Network. In: Proceedings of the Network and Distributed Systems Symposium (NDSS) (2005)
10. Bethencourt, J., Franklin, J., Vernon, M.: Mapping Internet Sensors with Probe Response Attacks. In: Proceedings of Usenix Security Symposium (2005)
11. Shinoda, Y., Ikai, K., Itoh, M.: Vulnerabilities of Passive Internet Threat Monitors. In: Proceedings of Usenix Security Symposium (2005)
12. Rajab, M., Monrose, F., Terzis, A.: Fast and Evasive Attacks: Highlighting the Challenges Ahead. Proceedings of the 9th International Symposium on Recent Advances in Intrusion Detection (RAID) (September 2006)
13. Oberheide, J., Karir, M.: Honeyd Detection via Packet Fragmentation. Technical report, Merit Networks Inc. (2006)
14. Sinha, S., Bailey, M., Jahanian, F.: Shedding Light on the Configuration of Dark Addresses. In: Proceedings of NDSS (2007)
15. Brownlee, N.: DNS Root/gTLD Performance Measurements. IETF Meeting (2001), http://www.caida.org/publications/presentations/ietf0112/
16. Nemeth, E.: DNS Damage - Measurements at a Root Server. IETF Meeting (2001), http://www.caida.org/publications/presentations/ietf0112/
17. Wessels, D., Fomenkov, M.: Wow, That's a Lot of Packets. In: Proceedings of Passive and Active Measurement Workshop (September 2003)
18. Jung, J., Sit, E., Balakrishnan, H., Morris, R.: DNS Performance and the Effectiveness of Caching. In: Proc. ACM SIGCOMM Internet Measurement Workshop (2001)
19. Gummadi, K.P., Saroiu, S., Gribble, S.D.: King: Estimating Latency between Arbitrary Internet End Hosts. In: Proceedings of SIGCOMM IMW (2002)
20. Internet Systems Consortium. ISC Internet Domain Survey Background (2006), http://www.isc.org/index.pl
21. Moore, D., Voelker, G., Savage, S.: Inferring Internet Denial of Service Activity. In: Proceedings of the 2001 USENIX Security Symposium (2001)