print

Detecting new network security threats using DNS and netflow traffic

---

Uncontrolled network traffic in organizations could lead to many malicious threats, such as data breach, server compromised, server availability, and others. Many network security threats can be detected by monitoring and analyzing network traffic. One of the emerging threats is Domain Name System (DNS) Distributed Denial of Service (DDoS) attack, which flood the authoritative DNS server with large amount of DNS request. Monitoring and understanding the traffic data could prevent such attack. Therefore, we present a technique for detecting DDoS attack by correlating DNS and NetFlow traffic. The idea is to show that NetFlow can be used as the first DDoS indicator and then DNS is used to evaluate and verify the DDoS. We propose to model the ratio DNS NXDOMAIN response and Information Entropy feature using statistical approach. The traffic is under anomaly condition if the traffic is outside from the standard deviation threshold. We discovered low volume and high volume DDoS attack using statistical approach during the experiment. Attackers’ botnet utilizes DNS to do DDoS called DNS water torture attack or random subdomain attack. The results of the experiment can be used to prevent the attack such as domain blacklist.

---

Availability

B02503

(Rack Thesis)

Available

Detail Information

Series Title

-

Call Number

2503

Publisher

: Swiss German University., 2017

Collation

-

Language

English

ISBN/ISSN

-

Classification

NONE

Content Type

-

Media Type

-

Carrier Type

-

Edition

-

Subject(s)

IT
Botnet
DNS
DDoS
Information Entropy
NetFlow
Network Anomaly Detection
Network Security Threats
Traffic Correlation

Specific Detail Info

-

Statement of Responsibility

-

Other version/related

File Attachment

Comments

---

You must be logged in to post a comment