Passive monitoring of DNS anomalies

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volumn 4579 LNCS, Issue , 2007, Pages 129-139

  Zdrnja, Bojan ^a   Brownlee, Nevil ^a   Wessels, Duane ^b  

^a UNIVERSITY OF AUCKLAND   (New Zealand)

^b Measurement Factory

Author keywords

[No Author keywords available]

Indexed keywords

COMPUTER CRIME; DATABASE SYSTEMS; GATEWAYS (COMPUTER NETWORKS);

INTERNET GATEWAY; SPAMMERS; SQL DATABASE;

INTERNET;

EID: 37849037483     PISSN: 03029743     EISSN: 16113349     Source Type: Book Series    
DOI: 10.1007/978-3-540-73614-1_8     Document Type: Conference Paper

References (19)

1. Mockapetris, P.V., Dunlap, K.J.: Development of the Domain Name System. In: ACM Symphosium proceedings on Communications architectures and protocols (SIGCOMM 88), vol. 18(4) (1998)
2. RUS-CERT: Passive DNS replication, http://cert.uni-stuttgart.de/stats/ dns-replication.php
3. Schonewille, A., Helmond, D.v.: The Domain Name Service as an IDS. Research Project for the Master System- and Network Engineering at the University of Amsterdam (February 2006)
4. Kristoff, J.: DNSWatch, http://aharp.ittns.northwestern.edu/software/ dnswatch
5. Elton, N., Keel, M.: A Discussion of Bot Networks. EDUCAUSE 2005 (April 2005) http://www.educause.edu/ir/library/pdf/SPC0568.pdf
6. TCPDUMP/libpcap public repository, http://www.tcpdump.org
7. Mockapetris, P.: Domain Names Implementation and Specification. RFC 1035 (November 1987)
8. Tcpdpriv - A program for eliminating confidential information from packets collected on a network interface (October 2005) http://ita.ee.lbl.gov/ html/contrib/tcpdpriv.html
9. Jung, J., Sit, E., Balakrishnan, H., Morris, R.: DNS Performance and the Effectiveness of Caching. ACM Transactions on Networking 10(5), 589-603 (2002)
10. Wong, M.: Sender Authentication What To Do. A Messaging Anti-Abuse Working Group White Paper (November 2004) available at http://www.openspf.org/ whitepaper.pdf
11. Sequitur IPS: Domain name disputes, cybersquatting and UDRP cases. http://www.sequitur-ips.com/domain-name-disputes/library.html
12. Gavron, E.: A Security Problem and Proposed Correction With Widely Deployed DNS Software. RFC 1535 (October 1993)
13. Wang, Y., Beck, D., Wang, J., Verbowski, C., Daniels, B.: Strider Typo-Patrol: Discovery and Analysis of Systematic Typo-Squatting. Microsoft Research Technical Report (to be submitted to the 2nd Usenix Workshop on Steps to Reducing Unwanted Traffic on the Internet (SRUTI 06)) http://research. microsoft.com/URLTracer
14. Evron, G., Blog, S.: Looking behind the smoke screen of the Internet: DNS recursive attacks, spamvertised domains, phishing, botnet C&Cs, International Infrastructure and you, http://blogs.securiteam.com/index.php/ Eirchives/298
15. Daigle, L.: WHOIS: Protocol Specification. RFC 3912 (September 2004)
16. SURBL Spam URI Realtime Blocklists, http://www.surbl.org
17. Weimer, F.: Passive DNS Replication. FIRST 2005 (April 2005)
18. Internet Engineering Task Force: Requirements for Internet Hosts Application and Support. RFC 1123 (October 1989)
19. Vixie, P.: Extension Mechanisms for DNS (EDNSO). RFC 2671 (August 1999)