DNSSM: A large scale passive DNS security monitoring framework

Samuel Marchal; Jerome Francois; Cynthia Wagner; Radu State; Alexandre Dulaunoy; Thomas Engel; Olivier Festor

doi:10.1109/NOMS.2012.6212019

DNSSM: A large scale passive DNS security monitoring framework

Samuel Marchal
, Jerome Francois
, Cynthia Wagner
, Radu State
, Alexandre Dulaunoy
, Thomas Engel
, Olivier Festor

Not published at VTT

University of Luxembourg
Computer Incident Response Center Luxembourg (CIRCL)
Institut national de recherche en informatique et en automatique (INRIA)

Research output: Chapter in Book/Report/Conference proceeding › Conference article in proceedings › Scientific › peer-review

23 Citations (Scopus)

Abstract

We present a monitoring approach and the supporting software architecture for passive DNS traffic. Monitoring DNS traffic can reveal essential network and system level activity profiles. Worm infected and botnet participating hosts can be identified and malicious backdoor communications can be detected. Any passive DNS monitoring solution needs to address several challenges that range from architectural approaches for dealing with large volumes of data up to specific Data Mining approaches for this purpose. We describe a framework that leverages state of the art distributed processing facilities with clustering techniques in order to detect anomalies in both online and offline DNS traffic. This framework entitled DNSSM is implemented and operational on several networks. We validate the framework against two large trace sets ¹.

Original language	English
Title of host publication	2012 IEEE Network Operations and Management Symposium
Publisher	IEEE Institute of Electrical and Electronic Engineers
Pages	988-993
Number of pages	6
ISBN (Electronic)	978-1-4673-0269-2, 78-1-4673-0268-5
ISBN (Print)	78-1-4673-0267-8
DOIs	https://doi.org/10.1109/NOMS.2012.6212019
Publication status	Published - 2012
MoE publication type	A4 Article in a conference publication
Event	2012 IEEE Network Operations and Management Symposium, NOMS 2012 - Maui, HI, United States Duration: 16 Apr 2012 → 20 Apr 2012

Conference

Conference	2012 IEEE Network Operations and Management Symposium, NOMS 2012
Country/Territory	United States
City	Maui, HI
Period	16/04/12 → 20/04/12

Access to Document

10.1109/NOMS.2012.6212019

Cite this

@inproceedings{048ac4d8602441fda3b891e28252a5ff,

title = "DNSSM: A large scale passive DNS security monitoring framework",

abstract = "We present a monitoring approach and the supporting software architecture for passive DNS traffic. Monitoring DNS traffic can reveal essential network and system level activity profiles. Worm infected and botnet participating hosts can be identified and malicious backdoor communications can be detected. Any passive DNS monitoring solution needs to address several challenges that range from architectural approaches for dealing with large volumes of data up to specific Data Mining approaches for this purpose. We describe a framework that leverages state of the art distributed processing facilities with clustering techniques in order to detect anomalies in both online and offline DNS traffic. This framework entitled DNSSM is implemented and operational on several networks. We validate the framework against two large trace sets 1.",

author = "Samuel Marchal and Jerome Francois and Cynthia Wagner and Radu State and Alexandre Dulaunoy and Thomas Engel and Olivier Festor",

year = "2012",

doi = "10.1109/NOMS.2012.6212019",

language = "English",

isbn = "78-1-4673-0267-8",

pages = "988--993",

booktitle = "2012 IEEE Network Operations and Management Symposium",

publisher = "IEEE Institute of Electrical and Electronic Engineers",

address = "United States",

note = "2012 IEEE Network Operations and Management Symposium, NOMS 2012 ; Conference date: 16-04-2012 Through 20-04-2012",

}

Marchal, S, Francois, J, Wagner, C, State, R, Dulaunoy, A, Engel, T & Festor, O 2012, DNSSM: A large scale passive DNS security monitoring framework. in 2012 IEEE Network Operations and Management Symposium., 6212019, IEEE Institute of Electrical and Electronic Engineers, pp. 988-993, 2012 IEEE Network Operations and Management Symposium, NOMS 2012, Maui, HI, United States, 16/04/12. https://doi.org/10.1109/NOMS.2012.6212019

DNSSM: A large scale passive DNS security monitoring framework. / Marchal, Samuel; Francois, Jerome; Wagner, Cynthia et al.
2012 IEEE Network Operations and Management Symposium. IEEE Institute of Electrical and Electronic Engineers, 2012. p. 988-993 6212019.

Research output: Chapter in Book/Report/Conference proceeding › Conference article in proceedings › Scientific › peer-review

TY - GEN

T1 - DNSSM

T2 - 2012 IEEE Network Operations and Management Symposium, NOMS 2012

AU - Marchal, Samuel

AU - Francois, Jerome

AU - Wagner, Cynthia

AU - State, Radu

AU - Dulaunoy, Alexandre

AU - Engel, Thomas

AU - Festor, Olivier

PY - 2012

Y1 - 2012

N2 - We present a monitoring approach and the supporting software architecture for passive DNS traffic. Monitoring DNS traffic can reveal essential network and system level activity profiles. Worm infected and botnet participating hosts can be identified and malicious backdoor communications can be detected. Any passive DNS monitoring solution needs to address several challenges that range from architectural approaches for dealing with large volumes of data up to specific Data Mining approaches for this purpose. We describe a framework that leverages state of the art distributed processing facilities with clustering techniques in order to detect anomalies in both online and offline DNS traffic. This framework entitled DNSSM is implemented and operational on several networks. We validate the framework against two large trace sets 1.

AB - We present a monitoring approach and the supporting software architecture for passive DNS traffic. Monitoring DNS traffic can reveal essential network and system level activity profiles. Worm infected and botnet participating hosts can be identified and malicious backdoor communications can be detected. Any passive DNS monitoring solution needs to address several challenges that range from architectural approaches for dealing with large volumes of data up to specific Data Mining approaches for this purpose. We describe a framework that leverages state of the art distributed processing facilities with clustering techniques in order to detect anomalies in both online and offline DNS traffic. This framework entitled DNSSM is implemented and operational on several networks. We validate the framework against two large trace sets 1.

UR - https://www.scopus.com/pages/publications/84864221133

U2 - 10.1109/NOMS.2012.6212019

DO - 10.1109/NOMS.2012.6212019

M3 - Conference article in proceedings

AN - SCOPUS:84864221133

SN - 78-1-4673-0267-8

SP - 988

EP - 993

BT - 2012 IEEE Network Operations and Management Symposium

PB - IEEE Institute of Electrical and Electronic Engineers

Y2 - 16 April 2012 through 20 April 2012

ER -

DNSSM: A large scale passive DNS security monitoring framework

Abstract

Conference

Access to Document

Other files and links

Fingerprint

Cite this