A study on ambient DNS sensor

2017 Fiscal Year Final Research Report

• Project/Area Number: 15H02699
• Research Category: Grant-in-Aid for Scientific Research (B)
• Allocation Type: Single-year Grants
• Section: 一般
• Research Field: Information network
• Research Institution: National Institute of Informatics
• Principal Investigator: Fukuda Kensuke 国立情報学研究所, アーキテクチャ科学研究系, 准教授 (90435503)
• Co-Investigator(Renkei-kenkyūsha): Mazel Johan 国立情報システムセキュリティ庁, 研究部門, 研究員
• Research Collaborator: Heidemann John 南カリフォルニア大学, 情報科学研究所, 教授 ; Kato Akira 慶應義塾大学, 大学院・メディアデザイン研究科, 教授
• Project Period (FY): 2015-04-01 – 2018-03-31
• Keywords: インターネット / DNS / セキュリティ

Outline of Final Research Achievements

We design and evaluate a new type of network event sensor, called DNS backscatter, in order to detect network-wide events such as benign (CDN, mail, web crawler) and malicious (spam, scan) activities. DNS backscatter is a reverse DNS query generated at caching resolvers (queriers) close to a target for resolving IP address of an originator. We leverage on machine learning technique to identifying the type of such events. We demonstrate the effectiveness of DNS backscatter with two root DNS servers and one ccTLD.

Free Research Field

インターネット工学