NDLI: Detecting Malicious Activity with DNS Backscatter

Please wait, while we are loading the content...

Measurement and Analysis of Traffic Exchange Services

MPLS Under the Microscope: Revealing Actual Transit Path Diversity

Empirical Analysis of Search Advertising Strategies

Reliable Recon in Adversarial Peer-to-Peer Botnets

An End-to-End Measurement of Certificate Revocation in the Web's PKI

Understanding Mobile Traffic Patterns of Large Scale Cellular Towers in Urban Environment

MoonGen: A Scriptable High-Speed Packet Generator

Is There WiFi Yet?: How Aggressive Probe Requests Deteriorate Energy and Throughput

Going Wild: Large-Scale Classification of Open DNS Resolvers

Management Plane Analytics

Examining How the Great Firewall Discovers Hidden Circumvention Servers

Peeking Beneath the Hood of Uber

Resilience of Deployed TCP to Blind Attacks

Is Explicit Congestion Notification usable with UDP?

Annoyed Users: Ads and Ad-Block Usage in the Wild

The Doppelgänger Bot Attack: Exploring Identity Impersonation in Online Social Networks

Detecting Malicious Activity with DNS Backscatter

Identifying Traffic Differentiation in Mobile Networks

Ting: Measuring and Exploiting Latencies Between All Tor Nodes

Electri-Fi Your Data: Measuring and Combining Power-Line Communications with WiFi

Who is .com?: Learning to Parse WHOIS Records

PerfSight: Performance Diagnosis for Software Dataplanes

Characterizing Smartphone Usage Patterns from Millions of Android Users

Temporal and Spatial Classification of Active IPv6 Addresses

Neither Snow Nor Rain Nor MITM...: An Empirical Analysis of Email Delivery Security

Investigating Interdomain Routing Policies in the Wild

Measuring the Impact and Perception of Acceptable Advertisements

Dissecting UbuntuOne: Autopsy of a Global-scale Personal Cloud Back-end

Opprentice: Towards Practical and Automatic Anomaly Detection Through Machine Learning

Tracking the Evolution and Diversity in Network Usage of Smartphones

Timeouts: Beware Surprisingly High Delay

Revisiting Network Energy Efficiency of Mobile Apps: Performance in the Wild

From .academy to .zone: An Analysis of the New TLD Land Rush

Leveraging Internet Background Radiation for Opportunistic Network Analysis

Offline Downloading in China: A Comparative Study

Are We One Hop Away from a Better Internet?

Affiliate Crookies: Characterizing Affiliate Marketing Abuse

Location, Location, Location: The Impact of Geolocation on Web Search Personalization

The Dark Menace: Characterizing Network-based Attacks in the Cloud

Opportunities and Challenges in Crowdsourced Wardriving

StreetSense: Effect of Bus Wi-Fi APs on Pedestrian Smartphone

Quantifying Interference between Measurements on the RIPE Atlas Platform

In and Out of Cuba: Characterizing Cuba's Connectivity

Analyzing the Performance of an Anycast CDN

Detecting Malicious Activity with DNS Backscatter

Content Provider	ACM Digital Library
Author	Heidemann, John Fukuda, Kensuke
Abstract	Network-wide activity is when one computer (the originator) touches many others (the targets). Motives for activity may be benign (mailing lists, CDNs, and research scanning), malicious (spammers and scanners for security vulnerabilities), or perhaps indeterminate (ad trackers). Knowledge of malicious activity may help anticipate attacks, and understanding benign activity may set a baseline or characterize growth. This paper identifies DNS backscatter as a new source of information about network-wide activity. Backscatter is the reverse DNS queries caused when targets or middleboxes automatically look up the domain name of the originator. Queries are visible to the authoritative DNS servers that handle reverse DNS. While the fraction of backscatter they see depends on the server's location in the DNS hierarchy, we show that activity that touches many targets appear even in sampled observations. We use information about the queriers to classify originator activity using machine-learning. Our algorithm has reasonable precision (70-80%) as shown by data from three different organizations operating DNS servers at the root or country-level. Using this technique we examine nine months of activity from one authority to identify trends in scanning, identifying bursts corresponding to Heartbleed and broad and continuous scanning of ssh.
Starting Page	197
Ending Page	210
Page Count	14
File Format	PDF
ISBN	9781450338486
DOI	10.1145/2815675.2815706
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2015-10-28
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Measurement Scanning Network activity Dns Internet Domain name system
Content Type	Text
Resource Type	Article

Central Library (ISO-9001:2015 Certified)
Indian Institute of Technology Kharagpur
Kharagpur, West Bengal, India | PIN - 721302

See location in the Map
03222 282435
Mail: support@ndl.gov.in

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in