NXNSAttack traffic detection method based on spatio-temporal feature fusion deep learning

LIU Yuxiang; MO Xiuliang; GONG Liangyi; LYU Kunxian; ZUO Peng

doi:10.11959/j.issn.2096-109x.2025050

您当前的位置：

首页 >

文章列表页 >

NXNSAttack traffic detection method based on spatio-temporal feature fusion deep learning

Papers | 更新时间：2025-09-12

- NXNSAttack traffic detection method based on spatio-temporal feature fusion deep learning
- Chinese Journal of Network and Information Security Vol. 11, Issue 4, Pages: 173-188(2025)
- 作者机构：
  
  1.天津理工大学计算机科学与工程学院，天津 300384
  2.中国科学院计算机网络信息中心，北京 100083
  3.中国科学院大学，北京 101408
  4.中国互联网络信息中心，北京 100070
- 作者简介：
- 基金信息：
  
  The National Key R&D Program for Young Scientists of China(2023YFB3105700);The Natural Science Foundation of China(62272440)
- DOI：10.11959/j.issn.2096-109x.2025050
  CLC： TP393
- Received：14 January 2025，
  
  Revised：2025-05-15，
  
  Published：25 August 2025
- 稿件说明：
移动端阅览
刘宇翔, 莫秀良, 宫良一, 等. 基于时空特征融合深度学习的NXNSAttack流量识别方法[J]. 网络与信息安全学报, 2025, 11(4): 173-188.

Format: LIU Y X, MO X L, GONG L Y, et al. NXNSAttack traffic detection method based on spatio-temporal feature fusion deep learning[J]. Chinese Journal of Network and Information Security, 2025, 11(4): 173-188.
刘宇翔, 莫秀良, 宫良一, 等. 基于时空特征融合深度学习的NXNSAttack流量识别方法[J]. 网络与信息安全学报, 2025, 11(4): 173-188. DOI： 10.11959/j.issn.2096-109x.2025050.

Format: LIU Y X, MO X L, GONG L Y, et al. NXNSAttack traffic detection method based on spatio-temporal feature fusion deep learning[J]. Chinese Journal of Network and Information Security, 2025, 11(4): 173-188. DOI： 10.11959/j.issn.2096-109x.2025050.

摘要

域名系统（domain name system

DNS）是互联网的重要基础设施，也是网络攻击的重灾区。作为DNS的重要组成部分，权威服务器对域名解析起到关键作用，也因此成为攻击者的重点攻击对象。研究人员发现，攻击者可以利用DNS递归解析器的漏洞发起针对权威服务器的基于NXNSAttack的分布式拒绝服务（distributed denial of service

DDoS）攻击。此外，该研究发现一种新的基于NXNSAttack的变种DDoS攻击，攻击者可以利用分布式自建权威服务器发起NXNSAttack。该攻击利用DNS递归解析器在NS（name server）记录查询关联分析方面的缺陷，以空间协同方式发起分

布式NXNSAttack（D.NXNSAttack）。针对上述两种NXNSAttack变种，提出了一种基于时空特征融合深度学习检测方法。所提方法包括流量采集、数据预处理、时空特征融合学习及攻击分类等模块。在流量信息图像化基础上，利用空间学习模型ShuffleNet和时序学习模型Mamba的学习优势来捕获正常流量与攻击流量的图像特征的差异，实现对两种不同类型的NXNSAttack流量的检测。基于大量网络靶场攻击流量的实验结果显示，所提方法的检测精确率超过98%、

1分数达到98.8%。

Abstract

The domain name system (DNS) is recognized as a critical infrastructure of the Internet and is frequently targeted by cyber-attacks. As an essential component of the DNS system

authoritative servers played a key role in domain name resolution and were therefore subject to frequent attacks. Recently

researchers found that vulnerabilities in DNS recursive resolvers could be exploited to launch distributed denial-of-service (DDoS) attacks based on NXNSAttack against authoritative servers. Furthermore

a new variant of DDoS attack based on NXNSAttack was identified in this study. Attackers were found to utilize distributed self-built authoritative DNS servers to launch the NXNSAttack. This attack leveraged the vulnerability of DNS recursive resolvers lacking correlation analysis for NS queries

and distributed NXNSAttack attacks (D.NXNSAttack) were conducted through spatial collaboration. To address these two types of NXNSAttack-based DDoS attacks

a detection method based on the fusion of spatial and temporal features using deep learning was proposed. The method comprised modules for traffic collection

data preprocessing

spatial-temporal feature fusion learning

and attack classification. By converting traffic information into images

the advantages of the spatial learning model ShuffleNet and the temporal learning model Mamba were utilized to capture differences between normal and attack traffic

enabling the detection of two distinct types of NXNSAttack attacks. Experimental results based on large volumes of attack traffic from multiple network ranges show that the detection accuracy of the proposed method exceeds 98%

and the

1-score reaches 98.8%.

关键词

Keywords

references

MOCKAPETRIS P , DUNLAP K J . Development of the domain name system [C ] // Symposium Proceedings on Communications Architectures and Protocols . New York : ACM , 1988 : 123 - 133 .

MIRKOVIC J , REIHER P . A taxonomy of DDoS attack and DDoS defense mechanisms [J ] . ACM SIGCOMM Computer Communication Review , 2004 , 34 ( 2 ): 39 - 53 .

ANTONAKAKIS M , APRIL T , BAILEY M , et al . Understanding the mirai botnet [C ] // Proceedings of the 26th USENIX Security Symposium (USENIX Security 17) . Berkeley : USENIX Association , 2017 : 1093 - 1110 .

GAO H Y , YEGNESWARAN V , JIANG J , et al . Reexamining DNS from a global recursive resolver perspective [J ] . IEEE/ACM Transactions on Networking , 2016 , 24 ( 1 ): 43 - 57 .

AFEK Y , BREMLER-BARR A , SHAFIR L . NXNSAttack: recursive DNS inefficiencies and vulnerabilities [C ] // Proceedings of the 29th USENIX Security Symposium (USENIX Security 2020) . Berkeley : USENIX Association , 2020 : 631 - 648 .

DAGON D , PROVOS N , LEE C , et al . Corrupted DNS resolution paths: the rise of a malicious resolution authority [C ] // Proceedings of the Network and Distributed System Security Symposium . Virginia : the Internet Society , 2008 .

TAYLOR V F , SPOLAOR R , CONTI M , et al . Robust smartphone app identification via encrypted network traffic analysis [J ] . IEEE Transactions on Information Forensics and Security , 2018 , 13 ( 1 ): 63 - 78 .

HAYES J , DANEZIS G . K-fingerprinting: a robust scalable Website fingerprinting technique [C ] // Proceedings of the 25th USENIX Security Symposium (USENIX Security 2016) . Berkeley : USENIX Association , 2016 : 1187 - 1203 .

BIERBRAUER D A , DE LUCIA M J , REDDY K , et al . Transfer learning for raw network traffic detection [J ] . Expert Systems with Applications , 2023 , 211 : 118641 .

NIKTABE S , LASHKARI A H , SHARMA D P . Detection, characterization, and profiling DoH Malicious traffic using statistical pattern recognition [J ] . International Journal of Information Security , 2024 , 23 ( 2 ): 1293 - 1316 .

TU Y , LIU S , SUN Q . DNS tunnelling detection by fusing encoding feature and behavioral feature [J ] . Computers & Security , 2023 , 132 : 103357 .

LIU G N , JIN L , HAO S , et al . Dial “N” for NXDomain: the scale, origin, and security implications of DNS queries to non-existent domains [C ] // Proceedings of the 2023 ACM on Internet Measurement Conference . New York : ACM , 2023 : 198 - 212 .

ZHENG W . The availability and security implica-tions of glue in the domain name system [J/OL ] . CoRR , abs/1605.01394, 2016 .

MOURA G C M , CASTRO S , HEIDEMANN J , et al . TsuNAME: exploiting misconfiguration and vulnerability to DDoS DNS [C ] // Proceedings of the 21st ACM Internet Measurement Conference . New York : ACM , 2021 : 398 - 418 .

AFEK Y , BREMLER-BARR A , STAJNROD S . NRDelegationAttack: Complexity DDoS attack on DNS recursive resolvers [C ] // Proceedings of the 32nd USENIX Security Symposium (USENIX Security 2023) . Berkeley : USENIX Association , 2023 : 3187 - 3204 .

史国振 , 李昆阳 , 刘瑶 , 等 . 基于深度残差胶囊网络与注意力机制的加密流量识别方法 [J ] . 网络与信息安全学报 , 2023 , 9 ( 1 ): 32 - 41 .

SHI G Z , LI K Y , LIU Y , et al . Encrypted traffic identification method based on deep residual capsule network with attention mechanism [J ] . Chinese Journal of Network and Information Security , 2023 , 9 ( 1 ): 32 - 41 .

LI H Y , LI Z , ZHANG S Y , et al . Malicious DNS detection by combining improved transformer and CNN [J ] . Scientific Reports , 2024 , 14 ( 1 ): 30248 .

GU A , DAO T . Mamba: linear-time sequence modeling with selective state spaces [EB ] . 2023 .

S R R , R R , MOHARIR M , et al . SCAPY- A powerful interactive packet manipulation program [C ] // Proceedings of the 2018 International Conference on Networking, Embedded and Wireless Systems (ICNEWS) . Piscataway : IEEE Press , 2018 : 1 - 5 .

WANG T Z , XIE X H , WANG W D , et al . NetMamba: efficient network traffic classification via pre-training unidirectional mamba [J ] . arXiv preprint arXiv: 2405.11449 , 2024 .

ZHANG X Y , ZHOU X Y , LIN M X , et al . ShuffleNet: an extremely efficient convolutional neural network for mobile devices [C ] // Proceedings of the 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition . Piscataway : IEEE Press , 2018 : 6848 - 6856 .

SINHA D , EL-SHARKAWY M . Thin MobileNet: an enhanced MobileNet architecture [C ] // Proceedings of the 2019 IEEE 10th Annual Ubiquitous Computing, Electronics & Mobile Communication Conference (UEMCON) . Piscataway : IEEE Press , 2019 : 0280 - 0285 .

MEHTA S , RASTEGARI M . MobileViT: light-weight, general-purpose, and mobile-friendly vision transformer [J ] . arXiv preprint arXiv: 2110.02178 , 2021 .

LIU Z , MAO H Z , WU C Y , et al . A ConvNet for the 2020 s[C ] // Proceedings of the 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) . Piscataway : IEEE Press , 2022 : 11966 - 11976 .

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Amplification vulnerability mining method based on state-guided

Large-scale measurement and analysis on misconfigurations of DNSSEC from recursive side

Related Author

JIANG Sikang

CAI Ruijie

YIN Xiaokang

CHEN Hongyu

LIU Shengli

LIU Linhui

TU Feifan

CHEN Yong

Related Institution

Information Engineering University

Institute of Cyberspace Security, Jinan University

⁰