Abstract:The DNS root server is at the top of the hierarchical structure of the DNS system and is the initial node that bootstraps all DNS queries. If the root server resolves abnormally, all domain name resolutions will fail, and many users cannot access the Internet. For this reason, this paper detects the root server itself resolution anomalies and non-self resolution anomalies by constructing high-confidence root zone file and anomaly judgment rules. First, we use the weighted voting statistics method to build high-confidence root zone file by calculating the confidence of multi-source root zone files. Based on high-confidence root zone files, we construct three types of anomaly detection judgment rules: (1) root-side resolution anomaly judgment rules based on feature value matching, (2) response hijacking judgment rules by correlating response anomaly features and resolution routing information, (3) root zone file synchronization anomaly judgment rules by calculating the relative synchronization delay of multi-source root zone files. Finally, using three anomaly judgment rules, we perform anomaly detection on the root resolution data obtained by active measurement. Our detection results show that root zone file synchronization delay distributions of different root server instances vary greatly. Some instances even show minute-level convergence, resulting in incorrect resolution for some TLDs. We also detect one response hijacking incident for 2 TLDs resolution, caused by the domain takeover mechanism adopted by the ISP to reduce inter-domain traffic settlement and decrease resolution latency. Except for the unresponsive exception caused by network packet loss, no root-side resolution anomaly is found, indicating that there is no artificial manipulation of TLD resolution on the root server and reflecting the responsibility of each root server operator aiming to maintain global Internet interconnection. The detection results show that the detection rules proposed in this paper can effectively achieve the anomaly detection of root server resolution and help to maintain the health and stability of the DNS system.

Classification of DNS Queries for Anomaly Detection

An Enhanced GHSOM for the Intrusion Detection

Intelligent model for the detection and classification of encrypted network traffic in cloud infrastructure

Tracking anomalous behaviors of name servers by mining DNS traffic

Identifying APT Malware Domain Based on Mobile DNS Logging

HGDom: Heterogeneous Graph Convolutional Networks for Malicious Domain Detection

HinDom: A Robust Malicious Domain Detection System based on Heterogeneous Information Network with Transductive Classification

Research on DNS Anomaly Detection Technology Based on Multiple Features

Identifying bot infection using neural networks on DNS traffic

A DATA ANALYZER IN NETWORK ANOMALY DETECTION SYSTEM BASED ON HIERARCHICAL SELF-ORGANIZING MAP

Detecting Data Leakage in DNS Traffic Based on Time Series Anomaly Detection.

Deepdom: Malicious Domain Detection with Scalable and Heterogeneous Graph Convolutional Networks

Detecting Botnet Activities Based on Abnormal DNS traffic

Detecting malware based on DNS graph mining

A Lightweight Double-Stage Scheme to Identify Malicious DNS over HTTPS Traffic Using a Hybrid Learning Approach

Anomaly-Based Web Attack Detection: A Deep Learning Approach

DNS Root Server Resolution Anomaly Detection

Detection of Data Leakage Based on DNS Traffic

A Transform Domain-Based Anomaly Detection Approach To Network-Wide Traffic

Censorship Data-Driven DNS Resolution Anomaly Detection: an Ensemble Algorithm Model with Multivariate Feature Fusion

Anomaly-Based Web Attack Detection