Detection of DNS anomalies using flow data analysis

GLOBECOM - IEEE Global Telecommunications Conference

Volumn , Issue , 2006, Pages

  Karasaridis, Anestis ^a   Meier Hellstern, Kathleen ^a   Hoeflin, David ^a  

^a AT AND T LABS RESEARCH   (United States)

Author keywords

Anomaly detection; Denial of service; DNS; Flow data; Network security; Relative entropy

Indexed keywords

ANOMALY DETECTION; DENIAL OF SERVICE; DOMAIN NAME SYSTEM (DNS); RELATIVE ENTROPY;

ALGORITHMS; COMPUTER CRIME; DATA FLOW ANALYSIS; INTERNET PROTOCOLS; NETWORK SECURITY; TELECOMMUNICATION TRAFFIC;

SIGNAL DETECTION;

EID: 50949121337     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/GLOCOM.2006.280     Document Type: Conference Paper

References (12)

1. P. Mockapetris, "Domain names - concepts and facilities," IETF, Request for Comments (RFC) 1034, 1987.
2. R. Chadramouli and S. Rose, "Challenges in securing the domain name system," IEEE Privacy and Security Magazine, January/February 2006.
3. Internet Systems Consortium, "Bind vulnerabilities," http://www.isc.org/index.pl?/sw/bind/bind-security.php, 2005.
4. Cisco Systems, "Cisco IOS Netflow," http://www.cisco.com.
5. J. Steward, "DNS Poisoning - The Next Generation," LURHQ Inc., Tech. Rep., 2002.
6. P. Vixie, "Extension Mechanisms for DNS," IETF, Request for Comments (RFC) 2671, 1999.
7. P. Mockapetris, "Domain names - implementation and specification," IETF, Request for Comments (RFC) 1035, 1987.
8. P-T. De Boer, D.P. Kroese, S. Mannor, R.Y. Rubinstein, "A tutorial on the cross entropy method," Annals of Operations Research, 2005.
9. Threat Intelligence Group, "Sinit p2p trojan analysis," http://www.lurhq.com/sinit.html, December 2003.
10. Internet Storm Center, "Trends," http://isc.sans.org, 2004.
11. John Schwartz, "Hackers steal from pirates, to no good end," New York Times, December 2003.
12. S. Kullback, Information Theory and Statistics. Dover Publications, 1968.