Survey on key technologies for protective DNS service

MA Yongzheng; LI Hongtao; MA Zhongsheng; HU Weihong; ZHANG Zhongxian

doi:10.11959/j.issn.2096-109x.2024065

您当前的位置：

首页 >

文章列表页 >

Survey on key technologies for protective DNS service

Topic：Internet DNS Security | 更新时间：2024-12-20

- Survey on key technologies for protective DNS service
- Chinese Journal of Network and Information Security Vol. 10, Issue 5, Pages: 39-55(2024)
- 作者机构：
  
  中国互联网络信息中心，北京 100190
- 作者简介：
- 基金信息：
  
  The National Key Research and Development Program of China(2022YFB3105000)
- DOI：10.11959/j.issn.2096-109x.2024065
  CLC： TP393
- Received：29 April 2024，
  
  Revised：2024-09-18，
  
  Published：25 October 2024
- 稿件说明：
移动端阅览
马永征, 李洪涛, 马中胜, 等. 防护性DNS服务关键技术研究综述[J]. 网络与信息安全学报, 2024, 10(5): 39-55.

Format: MA Y Z, LI H T, MA Z S, et al. Survey on key technologies for protective DNS service[J]. Chinese Journal of Network and Information Security, 2024, 10(5): 39-55.
马永征, 李洪涛, 马中胜, 等. 防护性DNS服务关键技术研究综述[J]. 网络与信息安全学报, 2024, 10(5): 39-55. DOI： 10.11959/j.issn.2096-109x.2024065.

Format: MA Y Z, LI H T, MA Z S, et al. Survey on key technologies for protective DNS service[J]. Chinese Journal of Network and Information Security, 2024, 10(5): 39-55. DOI： 10.11959/j.issn.2096-109x.2024065.

摘要

域名系统（domain name system，DNS）作为互联网资源的名字标识服务，提供了从域名到IP地址的查询转换功能，是用户访问互联网应用的入口，也是用户侧安全威胁感知与防御的关键点。用户侧常见的DNS滥用及相关安全威胁有：网络钓鱼、域名不良应用、恶意软件以及利用DNS进行攻击等。防护性DNS（protective DNS，PDNS）服务是一种利用DNS协议和架构的网络安全防护技术，通过对DNS查询进行威胁检测与处置，能够从源头上阻止用户对网络钓鱼网站、不良网站、恶意软件的访问。目前学界对PDNS服务还缺少系统的介绍与研究。对PDNS已有研究工作、应用现状及架构与功能进行系统梳理，对PDNS所涉及的关键技术进行系统综述，主要包括域名威胁处置技术、DNS异常检测技术、威胁情报管理技术和数据存储管理技术，分析PDNS目前面临的问题与挑战，并对PDNS未来发展趋势与研究方向提出了展望。

Abstract

The domain name system (DNS) is a naming service for Internet resources that provides the function of converting from domain names to IP addresses. It serves as the entry point for users to access Internet applications and is also the key point for client-side security threat perception and mitigation. Common DNS abuses and related security threats on the client side include phishing

malware

and other attacks based on DNS. The protective DNS (PDNS) service leverages the existing DNS protocol and architecture to detect and mitigate threats by analyzing DNS queries

thereby protecting users against potential security threads at the source. Currently

a systematic introduction and research on PDNS service in academia and industry is lacking. The existing work

application status

and architecture and functions of PDNS were systematically sorted out. The key technologies associated with PDNS

including DNS-related threat mitigation

DNS anomaly detection

threat intelligence management

and data storage and management technology

were reviewed. The issues and challenges faced by PDNS were analyzed

and future development trends and research directions for PDNS were proposed.

关键词

Keywords

references

FOUCHEREAU B . 2023 Global DNS threat report [R ] . IDC . 2023 .

DNS security threat mitigation program [EB ] . ICANN . 2023 .

Selecting a protective DNS service [EB ] . CISA . 2021 .

RADU R . DNS4EU: a step change in the EU’s strategic autonomy? [J ] . Journal of Cyber Policy , 2023 , 8 ( 2 ): 239 - 256 .

CARR A , ALAM A , ALLISON J . Monitoring malicious DNS queries: an experimental case study of utilising the national cyber security centre’s protective DNS within a UK public sector organisation [EB ] . 2023 .

RODRIGUEZ E , ANGHEL R , PARKIN S , et al . Two sides of the shield: understanding protective DNS adoption factors [C ] // Proceedings of 32nd USENIX Security Symposium , 2023 : 3135 - 3152 .

LIU M X , ZHANG Y M , LI X , et al . Understanding the implementation and security implications of protective DNS services [C ] // Proceedings of 2024 Network and Distributed System Security Symposium . Reston, VA : Internet Society , 2024 .

MOCKAPETRIS P . Domain names-concepts and facilities [R ] . 1987 .

张茜 , 延志伟 , 李洪涛 , 等 . 网络钓鱼欺诈检测技术研究 [J ] . 网络与信息安全学报 , 2017 , 3 ( 7 ): 7 - 24 .

ZHANG X , YAN Z W , LI H T , et al . Research of phishing detection technology [J ] . Chinese Journal of Network and Information Security , 2017 , 3 ( 7 ): 7 - 24 .

临江 . 去年全国受理网络违法和不良信息举报1.72亿件 [N ] , 人民邮电 , 2023 , 2 : 10 .

LIN J . Last year, 172 million reports of illegal and harmful information on the Internet were received nationwide [N ] . People's Posts and Telecommunications, 2023, 2 : 10 .

章思宇 . 基于DNS流量的恶意软件域名挖掘 [D ] . 上海 : 上海交通大学 , 2014 .

ZHANG S Y . Detecting malware domains on DNS traffic [D ] . Shanghai : Shanghai Jiao Tong University , 2014 .

VORMAYR G , ZSEBY T , FABINI J . Botnet communication patterns [J ] . IEEE Communications Surveys & Tutorials , 2017 , 19 ( 4 ): 2768 - 2796 .

JEITNER P , SHULMAN H . Injection attacks reloaded: tunnelling malicious payloads over DNS [C ] // Proceedings of 30th USENIX Security Symposium (USENIX Security 21). 2021 : 3165 - 3182 .

JACKSON C , BARTH A , BORTZ A , et al . Protecting browsers from DNS rebinding attacks [C ] // Proceedings of the 14th ACM Conference on Computer and Communications Security . New York : ACM , 2007 : 421 - 431 .

ACAR G , HUANG D Y , LI F , et al . Web-based attacks to discover and control local IoT devices [C ] // Proceedings of the 2018 Workshop on IoT Security and Privacy . New York : ACM , 2018 : 29 - 35 .

JENSEN B , NAIR D , ATALAN Y , et al . CISA’s evolving .gov mission: defending the United States’ federal executive agency networks [R ] . 2023 .

European Commission . The EU’s cybersecurity strategy for the digital decade [EB ] . 2020 .

HESSELMAN C , MOURA G , SCHMIDT R , et al . Increasing DNS security and stability through a control plane for top-level domain operators [J ] . IEEE Communications Magazine , 2017 , 55 : 197 - 203 .

VIXIE P , SCHRYVER V . DNS response policy zones (RPZ) [S ] . Internet Engineering Task Force 2018 .

WILDE N , JONES L , LOPEZ R , et al . A DNS RPZ firewall and current American DNS practice [C ] // Proceedings of International Conference on Information Science and Applications . Singapore : Springer , 2019 : 259 - 265 .

ICHISE H , JIN Y , IIDA K . Policy-based detection and blocking system for abnormal direct outbound DNS queries using RPZ [C ] // Proceedings of 2022 the 12th International Workshop on Computer Science and Engineering . WCSE , 2022 : 327 - 332 .

KIM H , CHOI S S , SONG J . A methodology for multipurpose DNS sinkhole analyzing double bounce emails [C ] // Proceedings of Neural Information Processing . Berlin Heidelberg : Springer 2013 : 609 - 616 .

LI Y C , CHU S N , XIAO R . A pharming attack hybrid detection model based on IP addresses and web content [J ] . Optik , 2015 , 126 ( 2 ): 234 - 239 .

CHIEW K L , CHANG E H , SZE S N , et al . Utilisation of website logo for phishing detection [J ] . Computers & Security , 2015 , 54 : 16 - 26 .

邹学强 , 张鹏 , 黄彩云 , 等 . 基于页面布局相似性的钓鱼网页发现方法 [J ] . 通信学报 , 2016 , 37 ( S1 ): 116 - 124 .

ZOU X Q , ZHANG P , HUANG C Y , et al . Phishing attacks discovery based on HTML layout similarity [J ] . Journal on Communications , 2016 , 37 ( S1 ): 116 - 124 .

RAO R S , PAIS A R . Jail-Phish: an improved search engine based phishing detection system [J ] . Computers and Security , 2019 , 83 ( C ): 246 - 267 .

JAIN A K , GUPTA B B . PHISH-SAFE: URL features-based phishing detection system using machine learning [C ] // Proceedings of Cyber Security . Singapore : Springer , 2018 : 467 - 474 .

PURBAY M , KUMAR D . Split behavior of supervised machine learning algorithms for phishing URL detection [C ] // Proceedings of Advances in VLSI, Communication, and Signal Processing . Singapore : Springer , 2021 : 497 - 505 .

YI P , GUAN Y X , ZOU F T , et al . Web phishing detection using a deep learning framework [J ] . Wireless Communications and Mobile Computing , 2018 , 2018 ( 1 ): 4678746 .

尚秋明 , 王利军 , 邓桂英 , 等 . 一种不良域名快速核验方法的研究 [J ] . 电子技术应用 , 2022 , 48 ( 10 ): 72 - 77 .

SHANG Q M , WANG L J , DENG G Y , et al . Research on a fast verification method for malicious domain names [J ] . Application of Electronic Technique , 2022 , 48 ( 10 ): 72 - 77 .

MIN M , LEE J , LEE K . Detecting illegal online gambling (IOG) services in the mobile environment [J ] . Security and Communication Networks , 2022 ( 1 ): 3286623 .

CHEN Y , ZHENG R , ZHOU A , et al . Automatic detection of pornographic and gambling websites based on visual and textual content using a decision mechanism [J ] . Sensors , 2020 , 20 ( 14 ): 3989 .

WANG C Y , ZHANG M , SHI F , et al . A hybrid multimodal data fusion-based method for identifying gambling websites [J ] . Electronics , 2022 , 11 ( 16 ): 2489 .

GRAHAM M , WINCKLES A , MOORE A . Botnet detection in virtual environments using Netflow [C ] // Proceedings of 7th International Conference on Cybercrime Forensics Education and Training , UK. 2014 .

GU G , PORRAS P A , YEGNESWARAN V , et al . BotHunter: detecting malware infection through IDS-driven dialog correlation [C ] // Proceedings of 16th USENIX Security Symposium . USENIX Association , 2007 .

RAHBARINIA B , PERDISCI R , ANTONAKAKIS M . Efficient and accurate behavior-based tracking of malware-control domains in large ISP networks [J ] . ACM Transactions on Privacy and Security , 2016 , 19 ( 2 ): 4 .

CHATZIS N , POPESCU-ZELETIN R . Flow level data mining of DNS query streams for email worm detection [C ] // Proceedings of the International Workshop on Computational Intelligence in Security for Information Systems CISIS’08 . Berlin Heidelberg : Springer , 2009 : 186 - 194 .

FERNANDEZ S , KORCZYNSKI M , DUDA A . Early detection of spam domains with passive DNS and SPF [C ] // Proceedings of International Conference on Passive and Active Network Measurement . Cham : Springer , 2022 : 30 - 49 .

CHOI H , LEE H , LEE H , et al . Botnet detection by monitoring group activities in DNS traffic [C ] // Proceedings of the 7th IEEE International Conference on Computer and Information Technology (CIT 2007) . Piscataway : IEEE Press , 2007 : 715 - 720 .

YADAV S , NARASIMHA REDDY A L . Winning with DNS failures: strategies for faster botnet detection [C ] // Proceedings of International Conference on Security and Privacy in Communication Systems . Berlin Heidelberg : Springer , 2012 : 446 - 459 .

YU X Z , ZHANG , B , KANG L , et al . Fast-Flux botnet detection based on weighted SVM [J ] . Information Technology Journal , 11 ( 8 ): 1048 - 1055 .

PERDISCI R , CORONA I , GIACINTO G . Early detection of malicious flux networks via large-scale passive DNS traffic analysis [J ] . IEEE Transactions on Dependable and Secure Computing , 2012 , 9 ( 5 ): 714 - 726 .

AL-DUWAIRI B , JARRAH M , SHATNAWI A . PASSVM: a highly accurate fast flux detection system [J ] . Computers & Security , 2021 . 110 : 102431 .

郎波 , 谢冲 , 陈少杰 , 等 . 基于多模态特征融合的Fast-Flux恶意域名检测方法 [J ] . 信息网络安全 , 2022 , 22 ( 4 ): 20 - 29 .

LANG B , XIE C , CHEN S J , et al . Fast-flux malicious domain Name detection method based on multimodal feature fusion [J ] . Netinfo Security , 2022 , 22 ( 4 ): 20 - 29 .

AGYEPONG E , BUCHANAN W J , JONES K . Detection of algorithmically generated malicious domain [C ] // Proceedings of the Computer Science & Information Technology . Academy & Industry Research Collaboration Center (AIRCC) . 2018 : 13 - 32 .

PATSAKIS C , CASINO F . Exploiting statistical and structural features for the detection of domain generation algorithms [J ] . Journal of Information Security and Applications , 2021 , 58 : 102725 .

WANG Z , JIA Z T , ZHANG B . A detection scheme for DGA domain names based on SVM [C ] // Proceedings of the 2018 International Conference on Mathematics, Modelling, Simulation and Algorithms (MMSA 2018) . Paris, France : Atlantis Press , 2018 : 257 - 263 .

于光喜 , 张棪 , 崔华俊 , 等 . 基于机器学习的僵尸网络DGA域名检测系统设计与实现 [J ] . 信息安全学报 , 2020 , 5 ( 3 ): 35 - 47 .

YU G X , ZHANG Y , CUI H J , et al . Design and implementation of a DGA domain Name detection system by machine learning [J ] . Journal of Cyber Security , 2020 , 5 ( 3 ): 35 - 47 .

YU B , GRAY D L , PAN J , et al . Inline DGA detection with deep networks [C ] // Proceedings of the 2017 IEEE International Conference on Data Mining Workshops (ICDMW) . Piscataway : IEEE Press , 2017 : 683 - 692 .

YILMAZ I , SIRAJ A , ULYBYSHEV D . Improving DGA-based malicious domain classifiers for malware defense with adversarial machine learning [C ] // Proceedings of the 2020 IEEE 4th Conference on Information & Communication Technology (CICT) . Piscataway : IEEE Press , 2020 : 1 - 6 .

MAIA R J M , RAY D , PENTYALA S , et al . An end-to-end framework for private DGA detection as a service [J ] . Cryptology ePrint Archive , 2023 .

SAMMOUR M , HUSSIN B , OTHMAN M F I , et al . DNS tunneling: a review on features [J ] . International Journal of Engineering & Technology , 2018 , 7 ( 3.20 ): 1 .

WANG Y , ZHOU A M , LIAO S , et al . A comprehensive survey on DNS tunnel detection [J ] . Computer Networks , 2021 , 197 : 108322 .

SHERIDAN S , KEANE A . Detection of DNS-based covert channel beacon signals [J ] . Journal of Information Warfare , 2015 , 14 ( 4 ): 100 - 114 .

BORN K , GUSTAFSON D . Detecting DNS tunnels using character frequency analysis [J ] . arXiv Preprint arXiv: 1004.4358 , 2010 .

章思宇 , 邹福泰 , 王鲁华 , 等 . 基于DNS的隐蔽通道流量检测 [J ] . 通信学报 , 2013 , 34 ( 5 ): 143 - 151 .

ZHANG S Y , ZOU F T , WANG L H , et al . Detecting DNS-based covert channel on live traffic [J ] . Journal on Communications , 2013 , 34 ( 5 ): 143 - 151 .

LIU J K , LI S H , ZHANG Y Z , et al . Detecting DNS tunnel through binary-classification based on behavior features [C ] // Proceedings of the 2017 IEEE Trustcom/BigDataSE/ICESS . Piscataway : IEEE Press , 2017 : 339 - 346 .

ZHAO Y , YE H Z , LI L Z , et al . Detecting DNS tunnels using session behavior and random forest method [C ] // Proceedings of the 2020 IEEE Fifth International Conference on Data Science in Cyberspace (DSC) . Piscataway : IEEE Press , 2020 : 45 - 52 .

LIU C , DAI L , CUI W J , et al . A byte-level CNN method to detect DNS tunnels [C ] // Proceedings of the 2019 IEEE 38th International Performance Computing and Communications Conference (IPCCC) . Piscataway : IEEE Press , 2019 : 1 - 8 .

ZHANG J C , YANG L , YU S , et al . A DNS tunneling detection method based on deep learning models to prevent data exfiltration [C ] // Proceedings of International Conference on Network and System Security . Cham : Springer , 2019 : 520 - 535 .

郭烜臻 , 潘祖烈 , 沈毅 , 等 . 一种基于被动DNS数据分析的DNS重绑定攻击检测技术 [J ] . 信息网络安全 , 2021 , 21 ( 3 ): 87 - 95 .

GUO X Z , PAN Z L , SHEN Y , et al . DNS rebinding detection technology based on passive DNS data analysis [J ] . Netinfo Security , 2021 , 21 ( 3 ): 87 - 95 .

BRAHMASANI S , SIVASANKAR E . Two level verification for detection of DNS rebinding attacks [J ] . International Journal of System Assurance Engineering and Management , 2013 , 4 ( 2 ): 138 - 145 .

SPAULDING J , MOHAISEN A . Defending Internet of things against malicious domain names using D-FENS [C ] // Proceedings of the 2018 IEEE/ACM Symposium on Edge Computing (SEC) . Piscataway : IEEE Press , 2018 : 387 - 392 .

ANTONAKAKIS M , PERDISCI R , DAGON D , et al . Building a dynamic reputation system for DNS [C ] // Proceedings of 19th USENIX Security Symposium , Washington : USENIX Association , 2010 .

BILGE L , KIRDA E , KRUEGEL C , et al . EXPOSURE: finding Malicious domains using passive DNS analysis [C ] // Proceedings of the Network and Distributed System Security Symposium (NDSS) . 2011 : 1 - 17 .

MAHDAVIFAR S , MALEKI N , LASHKARI A H , et al . Classifying malicious domains using DNS traffic analysis [C ] // Proceedings of the 2021 IEEE Intl Conf on Dependable, Autonomic and Secure Computing, Intl Conf on Pervasive Intelligence and Computing, Intl Conf on Cloud and Big Data Computing, Intl Conf on Cyber Science and Technology Congress (DASC/PiCom/CBDCom/CyberSciTech) . Piscataway : IEEE Press , 2021 : 60 - 67 .

JUNG J , SIT E . An empirical study of Spam traffic and the use of DNS black lists [C ] // Proceedings of the 4th ACM SIGCOMM conference on Internet measurement . New York : ACM , 2004 : 370 - 375 .

MAGNUSSON J . Survey and analysis of DNS filtering components [EB ] . arXiv preprint arXiv: 2401.03864 , 2024 .

RAMSDALE A , SHIAELES S , KOLOKOTRONIS N . A comparative analysis of cyber-threat intelligence sources, formats and languages [J ] . Electronics , 2020 , 9 ( 5 ): 824 .

TSOCHEV G , YOSHINOV R . The research on intelligent DNS security [C ] // Proceedings of the 2020 IEEE 10th International Conference on Intelligent Systems (IS) . Piscataway : IEEE Press , 2020 : 409 - 414 .

GAO P , SHAO F , LIU X Y , et al . Enabling efficient cyber threat hunting with cyber threat intelligence [C ] // Proceedings of the 2021 IEEE 37th International Conference on Data Engineering (ICDE) . Piscataway : IEEE Press , 2021 : 193 - 204 .

INMON W H . 数据仓库 [M ] . 北京 : 机械工业出版社 , 2006 .INMONW H. Data warehouse [M ] . Beijing : China Machine Press , 2006.

CHANDRA P , GUPTA M K . Comprehensive survey on data warehousing research [J ] . International Journal of Information Technology , 2018 , 10 ( 2 ): 217 - 224 .

ARMBRUST M , GHODSI A , XIN R , et al . Lakehouse: a new generation of open platforms that unify data warehousing and advanced analytics [C ] // Proceedings of CIDR . 2021 , 8 : 28 .

WULLINK M , MOURA G C M , MÜLLER M , et al . ENTRADA: a high-performance network traffic data streaming warehouse [C ] // Proceedings of the NOMS 2016 - 2016 IEEE/IFIP Network Operations and Management Symposium . Piscataway : IEEE Press , 2016 : 913 - 918 .

Protective domain name system resolver service [EB ] . CISA . 2023 .

TOVARŇÁK D , RAČEK M , VELAN P . Cloud native data platform for network telemetry and analytics [C ] // Proceedings of the 2021 17th International Conference on Network and Service Management (CNSM) . Piscataway : IEEE Press , 2021 : 394 - 396 .

LI V G , DUNN M , PEARCE P , et al . Reading the tea leaves: a comparative analysis of threat intelligence .[C ] // Proceedings of 28th USENIX Association , 2019 : 851 - 867 .

DING S , ZHANG D Q , GE J G , et al . Encrypt DNS traffic: automated feature learning method for detecting DNS tunnels [C ] // Proceedings of the 2021 IEEE Intl Conf on Parallel & Distributed Processing with Applications , Big Data & Cloud Computing, Sustainable Computing & Communications, Social Computing & Networking . Piscataway : IEEE Press , 2021 : 352 - 359 .

LE F , WERTHEIMER D , CALO S , et al . NorBERT: Network representations through BERT for network analysis & management [C ] // Proceedings of the 2022 30th International Symposium on Modeling, Analysis, and Simulation of Computer and Telecommunication Systems (MASCOTS) . Piscataway : IEEE Press , 2022 : 25 - 32 .

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

No data

Related Author

No data

Related Institution

No data

⁰