Reference : DNSSM: A large-scale Passive DNS Security Monitoring Framework

	Document type :	Scientific congresses, symposiums and conference proceedings : Paper published in a journal
	Discipline(s) :	Engineering, computing & technology : Computer science
	To cite this reference:	http://hdl.handle.net/10993/13059

Title :	DNSSM: A large-scale Passive DNS Security Monitoring Framework
Language :	English
Author, co-author :	Marchal, Samuel [Université Poincaré, Nancy, France]
	François, Jérôme [University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) > >]
	Wagner, Cynthia [University of Luxembourg > Faculty of Science, Technology and Communication (FSTC) > Computer Science and Communications Research Unit (CSC) >]
	State, Radu [INRIA Nancy Grand Est, Nancy, France]
	Dulaunoy, Alexandre [> >]
	Engel, Thomas [University of Luxembourg > Faculty of Science, Technology and Communication (FSTC) > Computer Science and Communications Research Unit (CSC) >]
	Festor, Olivier [INRIA Nancy Grand Est]
Publication date :	Apr-2012
Journal title :	IEEE/IFIP Network Operations and Management Symposium
Publisher :	IEEE
Pages :	988 - 993
Peer reviewed :	Yes
Audience :	International
ISSN :	1542-1201
Event name :	NOMS 2012
Event date :	16-20 May 2012
Event place (city) :	Maui
Event country :	Hawaii
Keywords :	[en] Passive DNS Analysis ; Large scale Monitoring ; Data Mining
Abstract :	[en] We present a monitoring approach and the supporting software architecture for passive DNS traffic. Monitoring DNS traffic can reveal essential network and system level activity profiles. Worm infected and botnet participating hosts can be identified and malicious backdoor communications can be detected. Any passive DNS monitoring solution needs to address several challenges that range from architectural approaches for dealing with large volumes of data up to specific Data Mining approaches for this purpose. We describe a framework that leverages state of the art distributed processing facilities with clustering techniques in order to detect anomalies in both online and offline DNS traffic. This framework entitled DSNSM is implemented and operational on several networks. We validate the framework against two large trace sets.
Research centres :	Interdisciplinary Center for Security, Reliability and Trust
Target :	Researchers ; Professionals ; Students
Permalink :	http://hdl.handle.net/10993/13059
DOI :	10.1109/NOMS.2012.6212019

	File(s) associated to this reference
	Fulltext file(s): File Commentary Version Size Access Open access noms12 _cameraready.pdf Author postprint 947.4 kB View/Open Additional material(s): File Commentary Size Access Open access presentation.pdf 1.51 MB View/Open

All documents in ORBi^lu are protected by a user license.

 

University of Luxembourg Library |  Feedback |  Legal notices Site Map