direkt zum Inhalt springen

direkt zum Hauptnavigationsmenü

Sie sind hier

TU Berlin

Inhalt des Dokuments

Nikolaos Chatzis' Publications

Mass Mailing Worm Detection by Means of Situation Aware DNS
Citation key C-MMWDMSAD-07
Author Chatzis, Nikolaos
Title of Book Proceedings of the International Symposium on Autonomous Decentralized Systems (ISADS '07)
Pages 279–286
Year 2007
DOI http://dx.doi.org/10.1109/ISADS.2007.46
Address New York, NY, USA
Publisher IEEE
Abstract The domain name system (DNS) is a critical infrastructural component of Internet, since it constitutes the essential first link in the entire chain of Internet connectivity. Enriching DNS functionality with in-network decision making capabilities can enable DNS to protect effectively both itself and the Internet, minimizing simultaneously human intervention. Decision making builds on the concept of situation awareness i.e. the ability of the name servers to infer a behavioural model of each host sending queries to them. We present a method for automatic behaviour classification on the name servers to detect mass mailing worm activity. Our method is based on applying spatial data mining in combination with the wavelet transform on DNS queries. We present the experimental results collected after applying our method on real DNS traffic captured at the name servers of a corporate network, which serves daily 400-500 users
Download Bibtex entry

Zusatzinformationen / Extras

Quick Access:

Schnellnavigation zur Seite über Nummerneingabe

Auxiliary Functions