Censorship data-driven DNS resolution anomaly detection: An ensemble algorithm model with multivariate feature fusion

The Domain Name System (DNS), as a critical component of Internet infrastructure, is crucial for maintaining network stability and security. However, vulnerabilities in the DNS resolution process make it susceptible to various network attacks. Current DNS resolution anomaly detection methods are cha...

Celý popis

Uložené v:
Podrobná bibliografia
Vydané v:Computer networks (Amsterdam, Netherlands : 1999) Ročník 252; s. 110669
Hlavní autori: Li, Chao, Cheng, Yanan, Zhang, Zhaoxin, Zhang, ZunDong
Médium: Journal Article
Jazyk:English
Vydavateľské údaje: Elsevier B.V 01.10.2024
Predmet:
Anomaly detection
Censorship
Cybersecurity
DNS
Ensemble algorithm
DNS
Ensemble algorithm
Censorship
Cybersecurity
Anomaly detection
ISSN:1389-1286
On-line prístup:Získať plný text
Tagy: Pridať tag
Žiadne tagy, Buďte prvý, kto otaguje tento záznam!
Popis
Shrnutí:The Domain Name System (DNS), as a critical component of Internet infrastructure, is crucial for maintaining network stability and security. However, vulnerabilities in the DNS resolution process make it susceptible to various network attacks. Current DNS resolution anomaly detection methods are challenged by the scarcity of diverse anomalous sample data and the difficulty in accurately capturing such anomalies. To address those challenges, we firstly introduce a proactive anomaly detection method based on bidirectional national censorship behavior, abbreviated as CB-BiDAM. This method can collect diverse anomalous resolution data from multiple network spaces, covering common types of resolution anomalies and effectively solving the problem of sample scarcity. Further, we extract multidimensional features from four key aspects: response content, DNS attributes, resolution paths, and timing, to gain a deeper understanding of the relationship between multifaceted information in the DNS resolution process and anomalous events. Finally, based on these multidimensional features, we construct a DNS resolution anomaly detection model named DRADC, using a stacked ensemble approach. Through a series of comparative experiments, the DRADC model significantly outperforms existing machine learning algorithms in key metrics such as accuracy (97.48%), recall (96.87%), and F1 score (97.09%). Feature ablation experiments further demonstrates that incorporating multidimensional features significantly improves model performance, with a 3% increase in accuracy and a 3.5% increase in precision compared to models relying solely on response content features. By providing an accurate detection model for DNS resolution anomalies, this study aids network administrators in more effectively identifying and countering network attacks. Additionally, our research also contributes to the detection and response to domain censorship mechanisms, which is crucial for maintaining the openness and free flow of the Internet.
ISSN:1389-1286
DOI:10.1016/j.comnet.2024.110669