Securing the Internet by analysing and controlling DNS traffic: email worm detection and mitigation

The Domain Name System (DNS) is a critical infrastructure of the Internet because almost all applications that run on Internet-connected machines depend on the name resolution service it provides to work. The DNS consists of three components: the domain name space, the name servers, and the clients, formally referred to as resolvers. Due to its critical nature, the domain name space and the name servers have been for many years very attractive targets for attackers seeking to inflict widespread damage. To deal with this state of affairs, substantial attention and investment have been directed at enhancing the security of and protecting the DNS to ensure its continuous, reliable and efficient operation. This, in conjunction with a notable shift in the motivation and profile of attackers have led in recent years to a considerable change in the Internet attack landscape. Attacks have gradually become more sophisticated and focused, and financial gain has evolved into the major driving force behind them. In this new era, attackers have realised that misusing the name servers or exploiting the name resolution service comes with greater damage or economic profit than directly attacking the components of the DNS or disrupting the name resolution service. As an immediate consequence, the vast majority of Internet attacks nowadays produce an observable effect on the DNS traffic that traverses the Internet, the operation of the name servers, or in some cases on both. In the present study, it is shown that this observation opens a new and very promising perspective for effectively detecting and mitigating a wide variety of Internet attacks. To demonstrate the value of this perspective, the present study is devoted to detecting and mitigating Internet worms that along with bot software are the two major Internet threats network operators and end users face. The focus is particularly on email worms, which have been, and remain, a very popular medium for attackers to achieve their ends and, therefore, the most prevalent type of Internet worms and malicious software in general. The attackers’ ends include installing bot software designed to distribute unsolicited emails or launch targeted distributed denial of service attacks, stealing private information and destroying key data. In this thesis, a method for detecting user machines that are compromised by email worms on the local name servers is introduced. The method uses clustering and similarity search over time series derived from the DNS query streams of user machines. It is demonstrated that the method overcomes the limitations of the existing methods, exhibits remarkable accuracy and negligible false alarm rate, and can be effective in the long run. In addition, a method for containing email worms is introduced. The method uses a traffic control mechanism to regulate the DNS response streams that the local name servers return to user machines and, thereby, limit the rate at which compromised user machines spread email worms further. It is shown that the method has the potential to slow down the epidemics of email worms and contribute to reducing the illegitimate email and DNS traffic compromised user machines send to the Internet with minimally, if at all, affecting their legitimate traffic.