dns anomaly detection
play

DNS Anomaly Detection superDAD Nick Barendregt Hidde van der Heide - PowerPoint PPT Presentation

Apr 03, 2024 •256 likes •525 views

DNS Anomaly Detection superDAD Nick Barendregt Hidde van der Heide Agenda Introduction Methods Results Conclusion Questions and Discussion Introduction | Methods | Results | Conclusion | Questions and Discussion 3 / 25 Introduction

  1. DNS Anomaly Detection superDAD Nick Barendregt Hidde van der Heide

  3. Agenda Introduction Methods Results Conclusion Questions and Discussion Introduction | Methods | Results | Conclusion | Questions and Discussion 3 / 25

  4. Introduction "Examine the feasibility of detecting malware infected systems using DNS log data and develop a scheme for detecting these anomalies in DNS traffic. Develop a simple proof of concept capable of processing text based output from our DNS logger." Introduction | Methods | Results | Conclusion | Questions and Discussion 4 / 25

  5. Methods Non-DNS packets on port 53 MX requests Keyword detection Blacklists Covert channel (DNS tunnel) detection Character frequency analysis Fast-flux detection Timing analysis Scoring mechanism Introduction | Methods | Results | Conclusion | Questions and Discussion 5 / 25

  6. DNS Tunnel Detection Characteristics Non DNS data Large number of packets Large packets Long domain names Large strings in NULL or TXT records Random data when compressed or encrypted Introduction | Methods | Results | Conclusion | Questions and Discussion 6 / 25

  7. DNS Tunnel Detection Configure Iodine (tunnel DNS software) Downstream modes: Raw UDP NULL (experimental) TXT CNAME A etc. Encoded Base32/64/128 Introduction | Methods | Results | Conclusion | Questions and Discussion 7 / 25

  8. Character Frequency Analysis Introduction | Methods | Results | Conclusion | Questions and Discussion 8 / 25

  9. Character Frequency Analysis Introduction | Methods | Results | Conclusion | Questions and Discussion 9 / 25

  10. Fast-Flux Detection Introduction | Methods | Results | Conclusion | Questions and Discussion 10 / 25

  11. Fast-Flux Detection - Example $ dig naughtydateingsite.net ;; ANSWER SECTION: naughtydateingsite.net. 300 IN A 77.127.166.235 naughtydateingsite.net. 300 IN A 82.228.65.61 naughtydateingsite.net. 300 IN A 84.109.81.176 naughtydateingsite.net. 300 IN A 92.253.40.134 naughtydateingsite.net. 300 IN A 94.54.254.3 naughtydateingsite.net. 300 IN A 94.228.118.59 naughtydateingsite.net. 300 IN A 114.33.131.22 naughtydateingsite.net. 300 IN A 118.101.225.28 naughtydateingsite.net. 300 IN A 201.167.15.123 naughtydateingsite.net. 300 IN A 203.99.233.142 ;; AUTHORITY SECTION: naughtydateingsite.net. 172318 IN NS ns1.7418391.com. naughtydateingsite.net. 172318 IN NS ns2.7418391.com. naughtydateingsite.net. 172318 IN NS ns3.7418391.com. naughtydateingsite.net. 172318 IN NS ns4.7418391.com. naughtydateingsite.net. 172318 IN NS ns5.7418391.com. naughtydateingsite.net. 172318 IN NS ns6.7418391.com. ; ADDITIONAL SECTION: ns1.7418391.com. 85917 IN A 173.212.75.160 ns2.7418391.com. 85917 IN A 79.119.188.9 ns3.7418391.com. 85917 IN A 88.87.251.45 ns4.7418391.com. 85917 IN A 82.228.65.61 ns5.7418391.com. 85917 IN A 79.117.122.25 ns6.7418391.com. 85917 IN A 186.114.80.139 Introduction | Methods | Results | Conclusion | Questions and Discussion 11 / 25

  12. DNS Timing Analysis Group activity Regular queries (polling) Outside office hours Introduction | Methods | Results | Conclusion | Questions and Discussion 12 / 25

  13. Scoring Mechanism Introduction | Methods | Results | Conclusion | Questions and Discussion 13 / 25

  14. Results DNS Tunnel Detection Single Flux Detection Double Flux Detection Introduction | Methods | Results | Conclusion | Questions and Discussion 14 / 25

  15. DNS Tunnel Detection Configured DNS tunnel software Captured stream of scp 10Mb random data Loaded in memory with Python Scapy Created frequency distribution graphs with NLTK toolkit Compare: Other tunnel software Frequency distribution for top sites Frequency distribution for language Introduction | Methods | Results | Conclusion | Questions and Discussion 15 / 25

  16. DNS Tunnel Detection - Base 32 Introduction | Methods | Results | Conclusion | Questions and Discussion 16 / 25

  17. DNS Tunnel Detection - Base 128 Introduction | Methods | Results | Conclusion | Questions and Discussion 17 / 25

  18. DNS Tunnel Detection Introduction | Methods | Results | Conclusion | Questions and Discussion 18 / 25

  19. Fast-flux Detection Single Flux Detection Simple bash system nslookup Threaded python nslookup Double Flux Detection DNS library SOA Record A Record NS Record ANY Record Database Lookup previous entries Takes time with more data Introduction | Methods | Results | Conclusion | Questions and Discussion 19 / 25

  20. Fast Flux Detection Introduction | Methods | Results | Conclusion | Questions and Discussion 20 / 25

  21. Fast Flux Detection Introduction | Methods | Results | Conclusion | Questions and Discussion 21 / 25

  22. Conclusion Promising methods need to be done off-line The amount of data needed for proper time analysis becomes problematic Best probe position would be at the network border since TTL is unreliable Good results for methods, better when combined Yes! Introduction | Methods | Results | Conclusion | Questions and Discussion 22 / 25

  23. Future Work Create full working tool Research best scoring mechanism Timing analysis Live data Introduction | Methods | Results | Conclusion | Questions and Discussion 23 / 25

  24. Fun Facts Single: 116 x 1 x 10.728 = 1.244.448 Double: 174 x 3 x 10.728 = 5.600.016 Good : 22 x 3 x 10.000 = 660.000 + Total domain queries: 7.504.464 Extra 48 hour run: ~2.400.000 Tracked domains: 10.728 Unique IP addresses: 32.466 Total amount of time spend: ~5.000 minutes Lines of code: ~1500 Cups of coffee: 2 x 20 x ~4 = ~160 Research papers read: ~30 Introduction | Methods | Results | Conclusion | Questions and Discussion 24 / 25

  25. Questions and Discussion ? Introduction | Methods | Results | Conclusion | Questions and Discussio n 25 / 25

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend

Anomaly Detection of Trajectories Junier B. Oliva Anomaly Detection An anomaly (or outlier)

Anomaly Detection of Trajectories Junier B. Oliva Anomaly Detection An anomaly (or outlier)

Anomaly Detection of Trajectories Junier B. Oliva Anomaly Detection An anomaly (or outlier) in a dataset is an instance that is abnormal or unlikely based on the rest of the dataset If the instances in the dataset are labeled as

760 views • 19 slides
What is an anomaly? Alastair Rushworth Data Scientist DataCamp Anomaly Detection in R Defining

What is an anomaly? Alastair Rushworth Data Scientist DataCamp Anomaly Detection in R Defining

DataCamp Anomaly Detection in R ANOMALY DETECTION IN R What is an anomaly? Alastair Rushworth Data Scientist DataCamp Anomaly Detection in R Defining the term anomaly Anomaly: a data point or collection of data points that do not follow the

870 views • 21 slides
Anomaly Detection Jia-Bin Huang Virginia Tech Spring 2019 ECE-5424G / CS-5824 Administrative

Anomaly Detection Jia-Bin Huang Virginia Tech Spring 2019 ECE-5424G / CS-5824 Administrative

Anomaly Detection Jia-Bin Huang Virginia Tech Spring 2019 ECE-5424G / CS-5824 Administrative Anomaly Detection Motivation Developing an anomaly detection system Anomaly detection vs. supervised learning Choosing what features

514 views • 34 slides
Data Mining II Anomaly Detection Heiko Paulheim Anomaly Detection Also known as Outlier

Data Mining II Anomaly Detection Heiko Paulheim Anomaly Detection Also known as Outlier

Data Mining II Anomaly Detection Heiko Paulheim Anomaly Detection Also known as Outlier Detection Automatically identify data points that are somehow different from the rest Working assumption: There are considerably

984 views • 72 slides
Data Mining II Anomaly Detection Heiko Paulheim Anomaly Detection Also known as Outlier

Data Mining II Anomaly Detection Heiko Paulheim Anomaly Detection Also known as Outlier

Data Mining II Anomaly Detection Heiko Paulheim Anomaly Detection Also known as Outlier Detection Automatically identify data points that are somehow different from the rest Working assumption: There are considerably

905 views • 74 slides
Learning Rules for Anomaly Detection (LERAD) of Hostile Network Traffic Matt Mahoney Overview

Learning Rules for Anomaly Detection (LERAD) of Hostile Network Traffic Matt Mahoney Overview

Learning Rules for Anomaly Detection (LERAD) of Hostile Network Traffic Matt Mahoney Overview Prior Work in Network Anomaly Detection The 1999 DARPA Intrusion Detection Evaluation Packet Header Anomaly Detection (PHAD) Application

575 views • 18 slides
<Title> Yiqun Hu, SP Group Agenda Condition monitoring & anomaly detection

<Title> Yiqun Hu, SP Group Agenda Condition monitoring & anomaly detection

Data Council Singapre 2019 Autoencoder Forest for Anomaly Detection from IoT Time Series <Title> Yiqun Hu, SP Group Agenda Condition monitoring & anomaly detection Autoencoder for anomaly detection Autoencoder

540 views • 27 slides
In Incorporating Feedback in into Tree-based Anomaly Detection Shubhomoy Das, Weng-Keen Wong,

In Incorporating Feedback in into Tree-based Anomaly Detection Shubhomoy Das, Weng-Keen Wong,

In Incorporating Feedback in into Tree-based Anomaly Detection Shubhomoy Das, Weng-Keen Wong, Alan Fern, Thomas G. Dietterich and Md Amran Siddiqui School of EECS Anomaly Detection Goal: Identify rare or strange objects 2 Anomaly

756 views • 51 slides
Dataflow Anomaly Detection Presented By Archana Viswanath Computer Science and Engineering The

Dataflow Anomaly Detection Presented By Archana Viswanath Computer Science and Engineering The

Dataflow Anomaly Detection Presented By Archana Viswanath Computer Science and Engineering The Pennsylvania State University Anomaly Intrusion Detection Systems Anomaly Intrusion Detection Systems Model normal behavior. Attack - Any

417 views • 20 slides
Anomaly Based Network Intrusion Detection with Unsupervised Outlier Detection Jiong Zhang and

Anomaly Based Network Intrusion Detection with Unsupervised Outlier Detection Jiong Zhang and

Anomaly Based Network Intrusion Detection with Unsupervised Outlier Detection Jiong Zhang and Mohammad Zulkernine School of Computing Queens University, Kingston Ontario, Canada K7L 3N6 {zhang, mzulker} @cs.queensu.ca Abstract- Anomaly

284 views • 6 slides
Efficient Anomaly Detection by Isolation using Nearest Neighbour Ensemble Tharindu

Efficient Anomaly Detection by Isolation using Nearest Neighbour Ensemble Tharindu

Information Technology Efficient Anomaly Detection by Isolation using Nearest Neighbour Ensemble Tharindu Rukshan Bandaragoda Kai Ming Ting David Albrecht Fei Tony Liu Jonathan R. Wells Outline Overview of anomaly detection

657 views • 41 slides
Isolation trees Alastair Rushworth Data Scientist DataCamp Anomaly Detection in R Isolation

Isolation trees Alastair Rushworth Data Scientist DataCamp Anomaly Detection in R Isolation

DataCamp Anomaly Detection in R ANOMALY DETECTION IN R Isolation trees Alastair Rushworth Data Scientist DataCamp Anomaly Detection in R Isolation tree DataCamp Anomaly Detection in R Isolation tree plots DataCamp Anomaly Detection in R

631 views • 19 slides
On Entropy in Network Traffic Anomaly Detection Jayro Santiago-Paz, Deni Torres-Roman.

On Entropy in Network Traffic Anomaly Detection Jayro Santiago-Paz, Deni Torres-Roman.

Introduction Feature Extraction Entropy Calculation Anomaly detection Classification Open Issues On Entropy in Network Traffic Anomaly Detection Jayro Santiago-Paz, Deni Torres-Roman. Cinvestav, Campus Guadalajara, Mexico November 2015

690 views • 24 slides
ACCT 420: Topic modeling and anomaly detection Session 8 Dr. Richard M. Crowley 1 Front matter

ACCT 420: Topic modeling and anomaly detection Session 8 Dr. Richard M. Crowley 1 Front matter

ACCT 420: Topic modeling and anomaly detection Session 8 Dr. Richard M. Crowley 1 Front matter 2 . 1 Learning objectives Theory: NLP Anomaly detection Application: Understand annual report readability Examine the

1.12k views • 85 slides
An Evaluation of Effect of Packet Sampling on Anomaly Detection Method Takuya Motodate

An Evaluation of Effect of Packet Sampling on Anomaly Detection Method Takuya Motodate

An Evaluation of Effect of Packet Sampling on Anomaly Detection Method Takuya Motodate April 25, 2010 The 3rd CAIDA-WIDE-CASFI Joint Measurement Workshop @Osaka 1 2010 4 25 Background Anomaly Detection:

331 views • 20 slides
Anomaly Detection with State Space Models Multi-dimensional State Space Models SVD Method EM

Anomaly Detection with State Space Models Multi-dimensional State Space Models SVD Method EM

Anomaly Detection CAMCOS 2009 Introduction ADAPT Anomaly Detection with State Space Models Multi-dimensional State Space Models SVD Method EM Algorithm Kalman Filter Maja Derek, Kate Isaacs, Duncan McElfresh, Jennifer Alarm Murguia,

1.4k views • 96 slides
Mathematics 101: Tabular and Graphical Presentation of Data Olive R. Cawiding Department of

Mathematics 101: Tabular and Graphical Presentation of Data Olive R. Cawiding Department of

Mathematics 101: Tabular and Graphical Presentation of Data Olive R. Cawiding Department of Mathematics and Computer Science University of the Philippines Baguio Textual Presentation of Data Tabular Presentation of Data Graphical Presentation

672 views • 37 slides
PR PROPOS OPOSED ED B BAK AKAS ASSI D DEEP S EEP SEA POR EA PORT T CROS OSS R RIVER

PR PROPOS OPOSED ED B BAK AKAS ASSI D DEEP S EEP SEA POR EA PORT T CROS OSS R RIVER

PR PROPOS OPOSED ED B BAK AKAS ASSI D DEEP S EEP SEA POR EA PORT T CROS OSS R RIVER ER S STATE TE NIGER ERIA PR PROPOS OPOSED ED B BAK AKAS ASSI POR PORT OU T OUTL TLAY 2 BACKGROU OUND Greenfield 16.0m (draft)deep

174 views • 14 slides
1 2 3 4 1st development phase Port of Baku 2 ferry berths: 6,2 mln. tons 2 Ro-Ro berths: 1,8

1 2 3 4 1st development phase Port of Baku 2 ferry berths: 6,2 mln. tons 2 Ro-Ro berths: 1,8

1 2 3 4 1st development phase Port of Baku 2 ferry berths: 6,2 mln. tons 2 Ro-Ro berths: 1,8 mln. tons 7 general cargo berths: 7 mln. tons 1 Service berth : Total throughput : 15 mln. tons, including 100 000 TEU 5 2nd development phase

258 views • 14 slides
EUROPEAN EXPANSION Eimantas Kiudulas Managing Director, Klaipeda FEZ Management Company

EUROPEAN EXPANSION Eimantas Kiudulas Managing Director, Klaipeda FEZ Management Company

LOCATION FOR EUROPEAN EXPANSION Eimantas Kiudulas Managing Director, Klaipeda FEZ Management Company www.fez.lt Markets, served by existing Klaipeda FEZ companies Daily ferries to Sweden and Germany: Sweden overnight; Germany

357 views • 20 slides
Frequency Distribution and Summary Statistics Dongmei Li Department of Public Health Sciences

Frequency Distribution and Summary Statistics Dongmei Li Department of Public Health Sciences

Frequency Distribution and Summary Statistics Dongmei Li Department of Public Health Sciences Office of Public Health Studies University of Hawaii at M noa Outline 1. Stemplot 2. Frequency table 3. Summary statistics 2 1. Stem-and-leaf

924 views • 61 slides
Full Spectrum Analysis A description of the full spectrum plot with examples. Ray Kelm, PE

Full Spectrum Analysis A description of the full spectrum plot with examples. Ray Kelm, PE

Full Spectrum Analysis A description of the full spectrum plot with examples. Ray Kelm, PE President/Chief Engineer Kelm Engineering, LLC Time and Frequency Domain Basic FFT Plot Basic FFT Characteristics 1024 time waveform points used

207 views • 16 slides
FREQUENCY FEATURES OF 3D BASALT FIBER WOVEN COMPOSITES UNDER COMPRESSION AT HIGH STRAIN RATES Z.

FREQUENCY FEATURES OF 3D BASALT FIBER WOVEN COMPOSITES UNDER COMPRESSION AT HIGH STRAIN RATES Z.

18 TH INTERNATIONAL CONFERENCE ON COMPOSITE MATERIALS FREQUENCY FEATURES OF 3D BASALT FIBER WOVEN COMPOSITES UNDER COMPRESSION AT HIGH STRAIN RATES Z. Niu, P. Ma, L. Jin, B. Sun * College of Textiles, Donghua University, Shanghai, China, 201620

75 views • 4 slides
Dynamics of structures with uncertainties S Adhikari College of Engineering, Swansea University,

Dynamics of structures with uncertainties S Adhikari College of Engineering, Swansea University,

Dynamics of structures with uncertainties S Adhikari College of Engineering, Swansea University, Swansea UK Email: S.Adhikari@swansea.ac.uk http://engweb.swan.ac.uk/ adhikaris/ Twitter: @ProfAdhikari The University of Campinas, Campinas,

913 views • 76 slides

More recommend