About: Stream-wise Detection of Surreptitious Traffic over DNS

Facets (new session)
Description
Metadata
Settings
- owl:sameAs
- Inference Rule:

About: Stream-wise Detection of Surreptitious Traffic over DNS Goto Sponge NotDistinct Permalink

An Entity of Type : http://linked.opendata.cz/ontology/domain/vavai/Vysledek, within Data Space : linked.opendata.cz associated with source document(s)

Attributes	Values
rdf:type	skos:Concept http://linked.opendata.cz/ontology/domain/vavai/Vysledek
rdfs:seeAlso	http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=7033254
Description	The Domain Name System (DNS) belongs to crucial services in a computer network. Because of its importance, DNS is usually allowed in security policies. That opens a way to break policies and to transfer data from/to restricted area due to misusage of a DNS infrastructure. This paper is focused on a detection of communication tunnels and other anomalies in a DNS traffic. The proposed detection module is designed to process huge volume of data and to detect anomalies at near real-time. It is based on combination of statistical analysis of several observed features including application layer information. Our aim is a stream-wise processing of huge volume of DNS data from backbone networks. To achieve these objectives with minimal resource consumption, the detection module uses efficient extended data structures. The performance evaluation has shown that the detector is able to process approximately 511 thousand DNS flow records per second. In addition, according to experiments, a tunnel that lasts over 30 seconds can be detected in a minute. During the on-line testing on a real traffic from production network, the module signalized on average over 60 confirmed alerts including DNS tunnels per day. The Domain Name System (DNS) belongs to crucial services in a computer network. Because of its importance, DNS is usually allowed in security policies. That opens a way to break policies and to transfer data from/to restricted area due to misusage of a DNS infrastructure. This paper is focused on a detection of communication tunnels and other anomalies in a DNS traffic. The proposed detection module is designed to process huge volume of data and to detect anomalies at near real-time. It is based on combination of statistical analysis of several observed features including application layer information. Our aim is a stream-wise processing of huge volume of DNS data from backbone networks. To achieve these objectives with minimal resource consumption, the detection module uses efficient extended data structures. The performance evaluation has shown that the detector is able to process approximately 511 thousand DNS flow records per second. In addition, according to experiments, a tunnel that lasts over 30 seconds can be detected in a minute. During the on-line testing on a real traffic from production network, the module signalized on average over 60 confirmed alerts including DNS tunnels per day. (en)
Title	Stream-wise Detection of Surreptitious Traffic over DNS Stream-wise Detection of Surreptitious Traffic over DNS (en)
skos:prefLabel	Stream-wise Detection of Surreptitious Traffic over DNS Stream-wise Detection of Surreptitious Traffic over DNS (en)
skos:notation	RIV/63839172:_____/14:10130411!RIV15-MSM-63839172
http://linked.open...avai/riv/aktivita	P
http://linked.open...avai/riv/aktivity	P(LM2010005)
http://linked.open...vai/riv/dodaniDat	2015
http://linked.open...aciTvurceVysledku	Čejka, Tomáš
http://linked.open.../riv/druhVysledku	D - Článek ve sborníku
http://linked.open...iv/duvernostUdaju	S - Úplné a pravdivé údaje nepodléhající ochraně podle zvláštních právních předpisů
http://linked.open...titaPredkladatele	CESNET - zájmové sdružení právnických osob
http://linked.open...dnocenehoVysledku	47681
http://linked.open...ai/riv/idVysledku	RIV/63839172:_____/14:10130411
http://linked.open...riv/jazykVysledku	eng - angličtina
http://linked.open.../riv/klicovaSlova	iodine; communication tunnels; DNS; anomaly detection; stream-wise detection (en)
http://linked.open.../riv/klicoveSlovo	DNS communication tunnels stream-wise detection anomaly detection iodine
http://linked.open...ontrolniKodProRIV	[9E7EC11CFD13]
http://linked.open...v/mistoKonaniAkce	Athens
http://linked.open...i/riv/mistoVydani	Pomona, California, USA
http://linked.open...i/riv/nazevZdroje	2014 IEEE 19th International Workshop on Computer Aided Modeling and Design of Communication Links and Networks (CAMAD) (CAMAD 2014)
http://linked.open...in/vavai/riv/obor	IN
http://linked.open...ichTvurcuVysledku	1 (xsd:int)
http://linked.open...cetTvurcuVysledku	3 (xsd:int)
http://linked.open...vavai/riv/projekt	Large Infrastructure CESNET
http://linked.open...UplatneniVysledku	2014
http://linked.open...iv/tvurceVysledku	Čejka, Tomáš Kubátová, Hana Rosa, Zdeněk
http://linked.open...vavai/riv/typAkce	WRD - Světová
http://linked.open.../riv/zahajeniAkce	2014-12-01 (xsd:date)
number of pages	5 (xsd:int)
http://bibframe.org/vocab/doi	10.1109/CAMAD.2014.7033254
http://purl.org/ne...btex#hasPublisher	IEEE Communications Society
https://schema.org/isbn	978-1-4799-5725-5

Faceted Search & Find service v1.16.118 as of Jun 21 2024

Alternative Linked Data Documents: ODE Content Formats:

RDF

ODATA

Microdata

About

OpenLink Virtuoso version 07.20.3240 as of Jun 21 2024, on Linux (x86_64-pc-linux-gnu), Single-Server Edition (126 GB total memory, 47 GB memory in use)
Data on this page belongs to its respective rights holders.
Virtuoso Faceted Browser Copyright © 2009-2024 OpenLink Software