A wrinkle in time: a case study in DNS poisoning

The domain name system (DNS) provides a translation between readable domain names and IP addresses. The DNS is a key infrastructure component of the Internet and a prime target for a variety of attacks. One of the most significant threats to DNS’ well-being is a DNS poisoning attack in which the DNS...

Full description

Saved in:
Bibliographic Details
Published in:International journal of information security 2021-06, Vol.20 (3), p.313-329
Main Authors: Berger, Harel, Dvir, Amit Z., Geva, Moti
Format: Article
Language:English
Subjects:
Caching
Coding and Information Theory
Communications Engineering
Computer Communication Networks
Computer Science
Cryptology
Domain names
Empirical analysis
Internet service providers
Management of Computing and Information Systems
Networks
Operating Systems
Poisoning
Regular Contribution
Servers
URLs
Citations: Items that this one cites
Items that cite this one
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:The domain name system (DNS) provides a translation between readable domain names and IP addresses. The DNS is a key infrastructure component of the Internet and a prime target for a variety of attacks. One of the most significant threats to DNS’ well-being is a DNS poisoning attack in which the DNS responses are maliciously replaced, or poisoned, by an attacker. To identify this kind of attack, we start by an analysis of different kinds of response times. We present an analysis of typical and atypical response times, while differentiating between the different levels of DNS servers’ response times, from root servers down to internal caching servers. We successfully identify empirical DNS poisoning attacks based on a novel method for DNS response timing analysis. We then present a system we developed to validate our technique that does not require any changes to the DNS protocol or any existing network equipment. Our validation system tested data from different architectures including LAN and cloud environments and real data from an internet service provider. Our method and system differ from most other DNS poisoning detection methods and achieved high detection rates exceeding 98%. These findings suggest that when used in conjunction with other methods, they can considerably enhance the accuracy of these methods.
ISSN:1615-5262
1615-5270
DOI:10.1007/s10207-020-00502-x