Flow-based detection of DNS tunnels

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volumn 7943 LNCS, Issue , 2013, Pages 124-135

  Ellens, Wendy ^a   Zuraniewski, Piotr ^a,d   Sperotto, Anna ^b   Schotanus, Harm ^a   Mandjes, Michel ^c   Meeuwissen, Erik ^a  

^a TNO   (Netherlands)

^b UNIVERSITY OF TWENTE   (Netherlands)

^c UNIVERSITY OF AMSTERDAM   (Netherlands)

^d AGH UNIVERSITY OF SCIENCE AND TECHNOLOGY   (Poland)

Author keywords

anomaly detection; cyber security; DNS tunneling; network flows

Indexed keywords

ANOMALY DETECTION; CYBER SECURITY; FLOW INFORMATIONS; MONITORING AND ANALYSIS; NETWORK FLOWS; OPERATIONAL ENVIRONMENTS; SECURITY BREACHES; TUNNEL DETECTION;

ARTIFICIAL INTELLIGENCE; COMPUTER SCIENCE;

INTERNET PROTOCOLS;

EID: 84879642111     PISSN: 03029743     EISSN: 16113349     Source Type: Book Series    
DOI: 10.1007/978-3-642-38998-6_16     Document Type: Conference Paper

References (14)

1. Cisco.com: Cisco ios netflow configuration guide, release 12.4. (September 2010), http://www.cisco.com
2. Quittek, J., Zseby, T., Claise, B., Zander, S.: Requirements for IP Flow Information Export (IPFIX). RFC 3917, Informational (2004)
3. Sperotto, A., Schaffrath, G., Sadre, R., Morariu, C., Pras, A., Stiller, B.: An overview of ip flow-based intrusion detection. IEEE Communications Surveys & Tutorials 12(3), 343-356 (2010)
4. Sperotto, A., Mandjes, M.R.H., Sadre, R., de Boer, P.T., Pras, A.: Autonomic parameter tuning of anomaly-based idss: an ssh case study. IEEE Transactions on Network and Service Management 9, 128-141 (2012)
5. Mandjes, M., Żuraniewski, P.: M/G/∞ transience, and its applications to overload detection. Performance Evaluation 68(6), 507-527 (2011)
6. Nussbaum, L., Neyron, P., Richard, O.: On Robust Covert Channels Inside DNS. In: Gritzalis, D., Lopez, J. (eds.) SEC 2009. IFIP AICT, vol. 297, pp. 51-62. Springer, Heidelberg (2009)
7. Aiello, M., Merlo, A., Papaleo, G.: Performance assessment and analysis of DNS tunneling tools. Logic Journal of IGPL (2012)
8. Crotti, M., Dusi, M., Gringoli, F., Salgarelli, L.: Detecting HTTP Tunnels with Statistical Mechanisms. In: IEEE International Conference on Communications (ICC 2007), pp. 6162-6168 (June 2007)
9. Dusi, M., Crotti, M., Gringoli, F., Salgarelli, L.: Tunnel Hunter: Detecting application-layer tunnels with statistical fingerprinting. Computer Networks 53(1), 81-97 (2009)
10. Marchal, S., Francois, J.,Wagner, C., State, R., Dulaunoy, A., Engel, T., Festor, O.: DNSSM: A large scale passive DNS security monitoring framework. In: IEEE Network Operations and Management Symposium (NOMS 2012), pp. 988-993 (2012)
11. Karasaridis, A., Meier-Hellstern, K., Hoeflin, D.: NIS04-2: Detection of DNS Anomalies using Flow Data Analysis. In: IEEE International Conference on Global Telecommunications Conference (GLOBECOM 2006), pp. 1-6 (December 2006)
12. Callegari, C., Coluccia, A., D'Alconzo, A., Ellens, W., Giordano, S., Mandjes, M., Pagano, M., Pepe, T., Ricciato, F., Żuraniewski, P.: A methodological overview on anomaly detection. COST-TMA Book chapter (to appear, 2013)
13. Brodsky, B., Darkhovsky, B.: Nonparametric methods in change-point problems. Mathematics and Its Applications, vol. 243. Springer (1993)
14. Kolmogorov, A.: On the empirical determination of a distribution law (1933). In: Shiryayev, A. (ed.) Selected Works of A.N. Kolmogorov. Probability Theory and Mathematical Statistics, vol. II, pp. 139-146. Springer Netherlands (1992)