Context-aware clustering of DNS query traffic

Proceedings of the ACM SIGCOMM Internet Measurement Conference, IMC

Volumn , Issue , 2008, Pages 217-229

  Plonka, David ^a   Barford, Paul ^a  

^a UNIVERSITY OF WISCONSIN MADISON   (United States)

Author keywords

Design; Experimentation; Measurement; Performance

Indexed keywords

CAMPUS NETWORKS; CONTEXT-AWARE; DOMAIN NAME SYSTEMS; EXPERIMENTATION; GENERAL NETWORKS; LEVEL OF DETAILS; NETWORK TRAFFICS; PERFORMANCE; TIME-VARYING; TRAFFIC MONITORING;

INTERNET; INTERNET PROTOCOLS; MONITORING; SEMICONDUCTING INTERMETALLICS;

NETWORK MANAGEMENT;

EID: 63049115439     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1452520.1452547     Document Type: Conference Paper

References (39)

1. Spam and Open Relay Blocking System, http://www.sorbs.net.
2. J. Abley and K. Lindqvist. Operation of Anycast Services. IETF RFC 4786, December 2006.
3. N. Brownlee, K. Claffy, and E. Nemeth. DNS Measurements at a Root Server. In Proceedings of IEEE Global Telecommunications Conference (Globecom '01), San Antonio, TX, December 2001.
4. S. Cheshire. DNS Service Discovery, http://dns-sd.org.
5. S. Cheshire. Multicast DNS. http://multicastdns.orgi
6. S. Cheshire. Method and Apparatus for Detecting Incorrect Responses to Network Queries. United States Patent 20060253612, 2006.
7. K. Cho, R.. Kaizaki, and A. Kato. Aguri: An Aggregation-Based Traffic Profiler. In Proceedings of the Workshop on Quality of Future Internet Services (QofIS '01 ), Coimbra, Portugal, 2001.
8. T. Cormen, C. Leiserson, R. Rivest, and C. Stein. Introduction to Algorithms. Second Edition. The MIT Press and McGraw-Hill Book Company, 2001.
9. D. Dagon, N. Provos, C. Lee, and W. Lee. Corrupted DNS Resolution Paths: The Rise of a Malicious Resolution Authority. In Proceedings of Network and Distributed System Security Symposium (NDSS '08), San Diego, CA, February 2008.
10. D. Dagon, C. Zou, and W. Lee. Modeling Botnet Propagation Using Time Zones. In Proceedings of The Network and Distributed Systems Security Symposium (NDSS '06), San Diego, CA, February 2006.
11. D. Deitrich, S. Gill, B. Greene, N. Long, and R. Thomas. Bogon Reference. http://www.team-cymru.org/?sec=8&opt=25, 2001.
12. C. Dews, A. Wichmann, and A. Feldmann. An Analysis of Internet Chat Systems. In Proceedings of ACM Internet. Measurement Conference (IMC '03), Miami Beach, FL, October 2003.
13. J. Erman, M. Arlitt, and A. Mahanti. Traffic Classification Using Clustering Algorithms. In Proceedings of ACM SIGCOMM Workshop on Mining Network Data (MineNet '06), Pisa, Italy, September 2006.
14. C. Estan, S. Savage, and G. Varghese. Automatically Inferring Patterns of Resource Consumption in Network Traffic. In Proceedings of ACM SIGCOMM '03, Karlsruhe, Germany, August 2003.
15. C. Estan and G. Varghese. New Directions in Traffic Measurement and Accounting. In Proceedings of ACM SIGCOMM '02, Pittsburgh, PA, August 2002.
16. E. Gavron. A Security Problem and Proposed Correction With Widely Deployed DNS Software. IETF RFC 1535, October 1993.
17. R.. Hinden and S. Deering. IP Version 6 Addressing Architecture. IETF RFC 4291, February 2006.
18. J. Jung, E. Sit, H. Balakrishnan, and R, Morris. DNS Performance and the Effectiveness of Caching. IEEE/ACM lransactions on Networking, 10(5), October 2001.
19. T. Karagiannis, A. Broido, M. Faloutsos, and K. Claffy. Transport Layer Identification of P2P Traffic. In Proceedings of ACM Internet Measurement Conference (IMC '04), Taormina, Italy, October 2004.
20. T. Karagiannis, K. Papagiannaki, and M. Faloutsos. BLlNC: Multilevel Traffic Classication in the Dark. In Proceedings of ACM SIGCOMM '05, Philadelphia, PA, August 2005.
21. R.. Liston, S. Srinivasan, and E. Zegura. Diversity in DNS Performance Measures. In Proceedings of ACM Internet Measurement Workshop, Marseille, France, October 2002.
22. A. McGregor, M. Hall, P. Lorier, and J. Brunskill. Flow Clustering Using Machine Learning Techniques. In Proceedings of the Passive and Active Measurement Conference (PAM '04), Ant ibes Juan-les-Pins, France, April 2004.
23. P. Mockapetris. Domain Names - Concepts and Facilities. IETF RFC 1034, November 1987.
24. P. Mockapetris. Domain Names - Implementation and Specification. IETF RFC 1035, November 1987.
25. D. Plonka. The TreeTop analysis tool. http://net.doit.wise.edu/~plohka/ treetop/, 2008.
26. A. Ramachandran, N. Feamster, and D. Dagon. Revealing Botnet Membership Using DNSBL Counter-intelligence. In Proceedings of The USENIX Workshop on Steps to Reducing Unwanted Traffic in the Internet (SRUTI '06), San"Jose, CA, July 2006.
27. P. Ren, J. Kristoff, and B. Gooch. Visualizing DNS Traffic. In Proceedings of the 3rd International Workshop on Visualization for Computer Security (VizSEC '06), Alexandria, VA, November 2006.
28. M. Roesch. Snort - Lightweight Intrusion Detection for Networks. In Proceedings of USENIX LISA, Seattle, WA, November 1999.
29. M. Roughan, S. Sen, O. Spatscheck, and N. Duffield. Class-of-Service Mapping for QoS: A Statistical Signature-based Approach to IP Traffic Classication. In Proceedings of ACM Internet Measurement Conference (IMC '04), Taormina, Italy, October 2004.
30. K. Sklower. A Tree-Based Packet Routing Table for Berkeley Unix. In USENIX Winter Conference '91, Dallas, TX, January 1991.
31. D. Steinberg and S. Cheshire. Zero Configuration Networking: The Definitive Guide. 2005.
32. W. R. Stevens. TCP/IP Illustrated, Volume 1: The Protocols. Addison-Wesley, 1994.
33. F. Weimer. Passive DNS Replication. In Proceedings of FIRST Conference on Computer Security Incident Handling, Singapore, July 2005.
34. D. Wessels. dnstop. http://dns.measurement-factory.com/tools/dnstop/j, 2002
35. D. Wessels. Is Your Caching R.esolver Polluting the Internet? Proceedings of the ACM SIGCOMM Workshop on Network Troubleshooting: Research. Theory and Operations Practice Meet Malfunctioning Reality, August 2004.
36. D. Whyte, E. Kranakis, and P. Van Oorschot. DNS-Based Detection of Scanning Worms in an Enterprise Network. In Proceedings of Network and Distributed System Security Symposium (NDSS '05), San Diego, CA, February 2005.
37. V. Yegneswaran, J. Giffin, P. Barford, and S. Jha. An Architecture for Generating Symantic-Aware Signatures. In Proceedings of USENIX Security Symposium, Baltimore, MD, August 2005.
38. B. Zdrnja, N. Brownlee, and D. Wessels. Passive Monitoring of DNS Anomalies. In Proceedings of International Conference on Detection of Intrusions & Malware, and Vulnerability Assessment, Lucerne, Switzerland, July 2007.
39. J. Zhang, J. Rexford, and J. Feigenbaum. Learning-Based Anomaly Detection in BGP Updates. In Proceedings of ACM SIGCOMM Workshop on Mining Network Data (MineNet '05), Philadelphia, PA, August 2005.