DNS	  backsca*erの紹介	
国立情報学研究所	  福田 健介	

Detec.ng	  malicious	  ac.vity	  with	  DNS	  backsca*er	
Kensuke	  Fukuda	  (NII/Sokendai)	  John	  Heidemann	  (USC/ISI)	
Appeared	  	  in	  IMC2015	  h*p://www.fukuda-­‐lab.org/publica.ons/FH_imc2015.pdf	

2	• 2014:	  Heartbleed	  – A	  bug	  in	  cri.cal	  millions	  of	  Internet	  hosts	  – Security	  researchers	  scanned	  to	  ﬁnd	  unpatched	  servers	  • Ques.on:	  Who	  else	  was	  scanning?	  
– Criminals?	  
– Black	  hats?	  
– Others?	
3	

Goal:	  Finding	  Originators	  of	  Network-­‐wide	  events	
• Large-­‐scale	  event	  involves	  many	  Internet	  hosts	  – Malicious:	  Scan,	  A*acks,	  Spams	  – Benign:	  CDN,	  Web	  crawler,	  DNS,	  NTP,	  Updates	  – Border:	  Ad	  tracking	  • Importance	  of	  monitoring	  those	  events	  – Malicious:	  security	  considera.on	  – Benign:	  stability	  of	  infrastructure	  4	Our	  contribu.on	
• New	  data	  source	  -­‐	  DNS	  backsca*er	  -­‐	  to	  iden.fy	  network-­‐wide	  ac.vity	  – Deployable	  – Privacy	  friendly	  – Robust	  against	  malicious	  source	  • Validate	  with	  several	  DNS	  authorita.ve	  servers	  • Evaluate	  over	  .me:	  6	  months	  dataset	  5	Key	  idea	  of	  DNS	  backsca*er	
• Large	  event	  triggers	  reverse	  DNS	  queries	  near	  target	  automa.cally	  +

He+
He+

He

– SMTP	  server:	  hostname	  of	  spammer	  – Firewall:	  hostname	  of	  scanner	  Detector– Web	  server:	  hostname	  of	  web	  crawler	  Backscatter

Projectile
energyAgAgAgMg
AgAgAgMg

AgAg

SamplematerialMg

AgLiAgAgAg• Many	  reverse	  DNS	  queries	  (DNS	  backsca*er)	  at	  auth	  server	  are	  hint	  to	  iden.fy	  events	
6	Detec.ng	  Events	  through	  DNS	  backsca*er	
Originator

TargetQuerier

Mailserverspam.bad.jp(1.2.3.4)

a.example.com(192.168.0.1)

Spammer

MailserverRecursive
resolverrdns.example.com(192.168.0.3)(5)	  analysis	  of	  the	  queriers	  tells	  about	  originator	  Authserverm.root-servers.net(1.in-addr.arpa)

b.example.com(192.168.0.2)(1)	  Q:	  who	  originates,	  and	  for	  what	  purpose?	  

Authority

Mailserver

Recursive
resolverc.example.jp(172.16.0.1)

rdns.example.jp(172.16.0.2)

a.dns.jp(2.1.in-addr.arpa)
bad.jp: the final authority(3.2.1.in-addr.arpa
and 4.3.2.1.in-addr.arpa)(4)	  DNS	  goes	  to	  the	  authority	  servers	  "PTR? 4.3.2.1.in-addr.arpa"(3)	  they	  m192.168.0.3
ake	  
Query log @ Auth server

SMTP (application traffic)(2)	  bothering	  many	  targets	  DNS: PTR? 4.3.2.1.in-addr.arpa

172.16.0.2 "PTR? 4.3.2.1.in-addr.arpa"
reverse	  DNS	  queries	  to	  log	  or	  check	  the	  originator	  Advantages	
• Deployable	  – Centralized	  monitoring	  at	  DNS	  authority	  • Privacy	  friendly	  – Informa.on	  is	  on	  queriers	  NOT	  originators	  – Reverse	  queries	  are	  generated	  automa.cally	  – Focus	  on	  large	  events	  (ignore	  small	  users)	  • Robust	  against	  malicious	  originators	  • Can	  infer	  diﬀerent	  class	  of	  originator	  (e.g.,	  scanner)	  with	  Machine	  Learning	  	8	Iden.ﬁca.on	  process	Labeled data
12 originator classes

Data
collection
Query log at Authority

Extract large
originators

Featureextraction

Class
Identification

Keep Originators
more than N queriers

Static: keywords
Dynamic: time&space

Supervised learning(Random forest)9	Discrimina.ve	  power	  of	  sta.c	  features	
1

fraction

0.8
0.6
0.4

other
other of	  mail	  Ra.os	  otheruncl
uncldiﬀerent	  are	  nxdom

uncl

other
uncl

other

other
uncl
spam

nxdom

nxdom
ns

other

nxdom uncl
nsns

Ra.o	  of	  spam	  is	  diﬀerent	  in	  mail	  and	  spam	  mailmail

nxdom nxdom
ns0.2

home

nsns

unclassified
spam
mailnxdomnshome home home

home home0
scn-icmp scn-ssh ad-track

cdn

mailspamSigniﬁcant	  ra.o	  of	  hhomeome	  case study

Diﬀerent	  mixes	  of	  features	  allow	  dis.nguishing	  diﬀerent	  classes	  of	  events	
10	

n nameitativetion ofin theny tarformay using
ecisionganizay-level.
ctivityentifyd con-etwork

Picking	  the	  best	  ML	  algorithm	
dataset algorithm accuracy precision recall F1-score
CART
0.66
0.63
0.600.61
JPRF
0.78
0.82
0.76
0.79
ditl
SVM
0.73
0.74
0.71
0.73
B
CART
0.48
0.48
0.45 RandomForest	  0.46
postRF
0.62
0.66
0.60
0.63
is	  best	  ditl
SVM
0.38
0.50
0.32
0.39
CART
0.53
0.52
0.49
0.51
M
RF
0.68
0.74
0.63
0.68
ditl
SVM
0.60
0.68
0.52
0.59
CART
0.61
0.65 Hope	  0.58
0.61 with	  to	  improve	  M
RF
0.79
0.82 be*er	  0.77training	  0.79data	  sampled
SVM
0.72
0.76
0.70
0.73

• Cross	  valida.on	  with	  3	  ML	  algorithms	  Table 1: Validating classification against labeled ground• truth.
Num	  classes:	  12,	  labeled	  data:200-­‐800	  • Precision:	  70-­‐80%	  (imbalanced	  dataset	  problem)	
11	

Finding	  Network-­‐wide	  events	  over	  .me	all	  heartbleed	  scanning	  scanners	  small	  blip	  compared	  to	  con4nuous	  scanning	  mail	  cdn	  • Sampled	  M-­‐root	  dataset	

spam	  and	  other	  observable	  ac.vity	  12	Conclusion	
• DNS	  backsca*er	  -­‐	  a	  new	  data	  source	  for	  Internet-­‐wide	  events	  • Advantages:	  Originator

TargetMailserver– Deployable	  – Privacy-­‐friendly	  – Reasonable	  accuracy	  • Longitudinal	  results	  spam.bad.jp(1.2.3.4)

a.example.com(192.168.0.1)

Spammer

MailserverQuerier

Authority

Recursive
resolverrdns.example.com(192.168.0.3)

b.example.com(192.168.0.2)

Authserverm.root-servers.org
a.dns.jp
bad.jpMail
serverRecursive
resolverc.example.jp(172.16.0.1)

rdns.example.jp(172.16.0.2)
Query log @ Auth server

SMTP (application traffic)
DNS: PTR? 4.3.2.1.in-addr.arpa

192.168.0.3 "PTR? 4.3.2.1.in-addr.arpa"
172.16.0.2 "PTR? 4.3.2.1.in-addr.arpa"

1: The process behind a DNS backscatter senDNS	  operators	  may	  apply	  tFigure
his	  to	  detect	  arge	  events!	
sor: an originatorsendslmail
to targets,causing queries
observed at the authority.

13	sensor (§ 3) that detects large, automated activities that

1.2.3.4
and itunkno
Atresponfind thThis qdomai
the orthe hospam
may b
dedicaA re4.3.2
IP adInternample
use threvers