Analysis of DNS TXT Record Usage and Consideration of Botnet Communication Detection
Analysis of DNS TXT Record Usage and Consideration of Botnet Communication Detection
复制标题
DNS TXT记录使用分析及僵尸网络通信检测的思考
DOI：
10.1587/transcom.2017itp0009
复制
发表时间：
2018
期刊：
影响因子：
--
通讯作者：
K. Iida
中科院分区：
文献类型：
--
作者：
Hikaru Ichise;Yong Jin;K. Iida
摘要最近有几份报告称，受僵尸程序感染的计算机与Command和Control服务器之间存在僵尸网络通信基于DNSTXTrerecord类型的僵尸网络通信已经被许多网络攻击者所利用。然而，DNSTXTrerecord类型有多种合法的使用形式，例如主机名描述。为了检测和阻止基于DNSTXTrerecord类型的僵尸网络通信，我们首先区分DNS TXT记录类型的合法和可疑使用，然后分析从我们的校园网络获得的真实的DNS TXT查询数据。我们将从组织发出的DNS查询分为三种类型-通过解析器，间接和直接出站查询-并分别分析DNS TXT查询数据。我们使用99天的数据集用于通过解析器DNS TXT查询，使用87天的数据集用于间接和直接出站DNS TXT查询。我们的分析结果表明，通过解析器，间接和直接出站查询中分别约有30%，8%和19%的DNS TXT查询可以被艾德为可疑DNS流量。基于我们的分析，我们还考虑了一个全面的僵尸网络检测系统，并设计了一个原型系统。
SUMMARY There have been several recent reports that botnet commu-nicationbetweenbot-infectedcomputersandCommandandControlservers (C&Cservers)usingtheDomainNameSystem(DNS)protocolhasbeenusedbymanycyberattackers.Inparticular,botnetcommunicationbased ontheDNSTXTrecordtypehasbeenobservedinseveralkindsofbotnetattack.Unfortunately,theDNSTXTrecordtypehasmanyformsoflegiti-mateusage,suchashostnamedescription.Inthispaper,inordertodetectandblockoutbotnetcommunicationbasedontheDNSTXTrecordtype, we first differentiate between legitimate and suspicious usages of the DNS TXT record type and then analyze real DNS TXT query data obtained from our campus network. We divide DNS queries sent out from an organization into three types—via-resolver, and indirect and direct outbound queries— and analyze the DNS TXT query data separately. We use a 99-day dataset for via-resolver DNS TXT queries and an 87-day dataset for indirect and direct outbound DNS TXT queries. The results of our analysis show that about 30%, 8% and 19% of DNS TXT queries in via-resolver, indirect and direct outbound queries, respectively, could be identified as suspicious DNS traffic. Based on our analysis, we also consider a comprehensive botnet detection system and have designed a prototype system.