TU Berlin

Internet Network ArchitecturesMarco Canini's Publications


zur Navigation

Es gibt keine deutsche Übersetzung dieser Webseite.

Marco Caninis's Publications

Mass Mailing Worm Detection by Means of Situation Aware DNS
Zitatschlüssel C-MMWDMSAD-07
Autor Chatzis, Nikolaos
Buchtitel Proceedings of the International Symposium on Autonomous Decentralized Systems (ISADS '07)
Seiten 279–286
Jahr 2007
DOI http://dx.doi.org/10.1109/ISADS.2007.46
Adresse New York, NY, USA
Verlag IEEE
Zusammenfassung The domain name system (DNS) is a critical infrastructural component of Internet, since it constitutes the essential first link in the entire chain of Internet connectivity. Enriching DNS functionality with in-network decision making capabilities can enable DNS to protect effectively both itself and the Internet, minimizing simultaneously human intervention. Decision making builds on the concept of situation awareness i.e. the ability of the name servers to infer a behavioural model of each host sending queries to them. We present a method for automatic behaviour classification on the name servers to detect mass mailing worm activity. Our method is based on applying spatial data mining in combination with the wavelet transform on DNS queries. We present the experimental results collected after applying our method on real DNS traffic captured at the name servers of a corporate network, which serves daily 400-500 users
Download Bibtex Eintrag



Schnellnavigation zur Seite über Nummerneingabe