Sage Journals: Discover world-class research

Abstract

Anomalous traffics are those unusual and colossal hits a non-popular domain gets for a small epoch period in a day. Regardless of whether these anomalies are malicious or not, it is important to analyze them as they might have a dramatic impact on a customer or an end user. Identifying these traffic anomalies is a challenge, as it requires mining and identifying patterns among huge volume of data. In this paper, we provide a statistical and dynamic reputation based approach to identify unpopular domains receiving huge volumes of traffic within a short period of time. Our aim is to develop and deploy a lightweight framework in a monitored network capable of analyzing DNS traffic and provide early warning alerts regarding domains receiving unusual hits to reduce the collateral damage faced by an end–user or customer. The authors have employed statistical analysis, supervised learning and ensemble based dynamic reputation of domains, IP addresses and name servers to distinguish benign and abnormal domains with very low false positives.

Keywords

Domain Name System anomaly detection knowledge base hit analysis dynamic reputation

Get full access to this article

View all access options for this article.

References

Mockapetris

Paul and Dunlap

K.J.

, Development of the domain name system, ACM18(4), 1988.

Yao

, Zhang

, Gao

and Hu

, Detection of Network Traffic Anomaly Based on Instantaneous Parameters Analysis, International Conference on Communication Technology, ICCT ’06 (2006), 1–4.

Tran

, Ma

and Sharma

, Network Anomaly Detection using Fuzzy Gaussian Mixture Models, Interna-tional Journal of Future Generation Communication and Networking (2006), 37–42.

Marina

and Ji

, Adaptive Thresholding for Pro-active Network Problem Detection, IEEE International Workshop on Systems Management5 (1998), 108–116.

Antonakakis

, et al. Building a Dynamic Reputation System for DNS. USENIX security symposium. 2010.

Drazin

, and Montag

, Decision tree analysis using WEKA. Machine Learning-Project II, University of Miami (2012), 1–3.

Witten

H.I.

, et al. Weka: Practical machine learning tools and techniques with Java implementations (1999), 81–17.

Weimer

, Passive DNS replication. FIRST Conference on Computer Security Incident, 2005.

Zdrnja

, Brownlee

and Wessels

, Passive monitoring of dns anomalies. Detection of Intrusions and Malware, and Vulnerability Assessment. Springer, Berlin Heidelberg (2007), 129–139.

10.

AWS | Alexa Top Sites - Up-to-date Lists of the Top Sites on the Web. Amazon Web Services, Inc. Web. 09 May 2016. <https://aws.amazon.com/alexa-top-sites/>

11.

Caceres

, Measurements of wide area internet traffic. University of California, Berkeley, Computer Science Division, 1989.

12.

Barford

and Plonka

. Characteristics of network traffic flow anomalies. Proceedings of the 1st ACM SIGCOMM Workshop on Internet Measurement. ACM, 2001.

13.

Claffy

, Polyzos

and Braun

H.W.

. Internet traffic flow profiling. UCSD TRCS93-328, SDSC GA-A6, (1993). http://www.caida.org/outreach/papers/itf.html

14.

Paxson

, Fast, approximate synthesis of fractional Gaussian noise for generating self-similar network traffic. ACM SIGCOMM Computer Communication Review27(5) (1997), 5–18.

15.

Roesch

, Snort: Lightweight Intrusion Detection for Networks. LISA99(1), 1999.

16.

Barford

, et al. A signal analysis of network traffic anomalies. Proceedings of the 2nd ACM SIGCOMM Work-shop on Internet measurment. ACM, 2002.

17.

Abry

and Veitch

. Wavelet analysis of long-range-dependent traffic. Information Theory, IEEE Transactions on44(1) (1998), 2–15.

18.

Gao

, et al. Anomaly detection of network traffic based on wavelet packet. Communications, 2006. APCC’06. Asia-Pacific Conference on. IEEE, 2006.

19.

Huang

C.-T.

, Thareja

and Shin

Y.-J.

, Wavelet-based real time detection of network traffic anomalies, Securecomm and Workshops. IEEE, 2006, 2006.

20.

and Lee

, DDoS attack detection and wavelets, Telecommunication Systems28(3–4) (2005), 435–451.

21.

and Ghorbani

A.A.

, Network anomaly detection based on wavelet analysis, EURASIP Journal on Advances in Signal Processing2009 (2009), 4.

22.

Domańska

, Domańska

and Czachórski

, A few investigations of long-range dependence in network traffic, Information Sciences and Systems 2014. Springer International Publishing (2014), 137–144.

23.

Feather

, Siewiorek

and Maxion

, Fault detection in an ethernet network using anomaly signature matching, ACM SIGCOMM Computer Communication Review23(4) (1993), ACM.

24.

Yuchi

, et al. A new statistical approach to DNS traffic anomaly detection. Advanced Data Mining and Applications. Springer, Berlin Heidelberg, (2010), 302–313.

25.

Fiadino

, et al. Towards automatic detection and diagnosis of Internet service anomalies via DNS traffic analysis. Wireless Communications and Mobile Computing Conference (IWCMC), 2015 International. IEEE, 2015.

26.

Mugali

A.A.

, Simpson

A.W.

and Walker.

S.K.

. System and method for detecting DNS traffic anomalies. U.S. Patent No. 9,172,716. 27 Oct. 2015.

27.

Holmes

A.D.

, et al. Existent domain name DNS traffic capture and analysis. U.S. Patent No. 8,521,908. 27 Aug. 2013.

28.

Bilge

, et al. EXPOSURE: Finding Malicious Domains Using Passive DNS Analysis. NDSS. 2011.

Why so abnormal? Detecting domains receiving anomalous surge traffic in a monitored network

Abstract

Keywords

Get full access to this article

References