Determining reputation of autonomous systems based on monitoring the DNS system
This post is an abstract and a translation of the work that was done by a former student and the original in Croatian can be found here. Some of the security omissions of the DNS system will be analyzed, a number of ways they can be monitored and how a reputation system can be built that will determine reputation according to the data collected.
Development of such system is essential for the security of todays Internet not only because DNS system can be exploited and used for malicious purposes, but also because those threats endanger the whole network community rather than just an individual operating system like DoS attacks. The domain name system (DNS) protocol doesnt implement any security mechanism because originally Internet wasnt intended for general public. However, there are some extensions which do cover critical weaknesses of the DNS protocol like domain name system security extensions (DNSSEC) which covers the DNS cache poisoning issue among others but still doesnt cover data confidentiality issue.
There are many ways to measure and monitor DNS traffic like methods which focus on latency of request and response, details of protocol design etc. The way it is measured also differs in client level, gateway level or AS (ISP and root DNS server) level. Measurements on the level of root DNS servers are the most useful for developing a reputation system because they analyze global trends of the DNS traffic.
Two types of unwanted DNS traffic will be mentioned while others can be found in the original work. Responses to requests with errors in format are a basic type of unwanted DNS traffic which is not wanted on the Internet. The server wastes resources just to correct errors in format, trying to read and respond to requests if its even possible. On the other hand, server can also be unable to respond to correctly formed requests in which case the reputation system tries not to penalize the client. Another interesting type of unwanted traffic belongs to DoS attacks. This kind of DoS attacks exploits root DNS servers sending DNS requests with spoofed source address set to victim and should be penalized the most.
The reputation system should consist of sensors on the borders of an AS. Their task is to monitor the network traffic in real time and catch any DNS traffic of interest. However, it is impossible to access strict borders of an AS. Solution is to view network traffic from a certain point within an AS and so the reputation is considered to be viewed and calculated from this point as well. Basically, the reputation system is consisted of several such points which monitor and gather data and allows an AS to measure the reputation and rank its neighbors accordingly.
In order to try and apply before mentioned theory, a series of practical measurements had been made using reputation system described in the original work.
download file now