DNSDNS""SPS ThreatAvert

DNS " DDoS   ( $305+
2018*6-27,
 ! "%&#1  '.4 6)/2
©Akamai Technologies, 2018

Nominum, now part of Akamai2

©Akamai Technologies, 2018

Akamai Technologies



3



©Akamai Technologies, 2018$&%&

+'()

& %
&!& !%&$ $  &    %    "   ! SPS Reach#&-.*#&%"

! DNSi CacheServe! DNSi AuthServe! DNSi Big Data Connector
#&,+4

Nominum | About Us! SPS Secure Business! SPS Secure Consumer! SPS Content Compliance ! SPS Secure Public Wi-Fi! SPS ThreatAvert

$!$%"$©Akamai Technologies, 2018

&,+$

DNSi CacheServe – KHmyV:+&; DNSd .>+4?,

•XStU{!

'"F>3– BF/1>D$4F@f– BIND njY510 L Os{R(QPS)
$F1FiY^Qq••

D/<F% '6?D'VG
– DNS A,D&Y^ q\);?,U~e– px

N]

Zk5?"F&=D– v_7?&F–?E-F*T– >)D'EF24F8D'usb}c'"F@ [M•lw•KHmy}oc$7F.gJ– CF@/C/$7F.IP

?@#?(9– :+&;E7(0D!ze– Wr |`eh– 24F8D'a

A7F,D!

?EBD©Akamai Technologies, 2018

DNS 

©Akamai Technologies, 2018 : 

50 " ThreatAvert "2.5".<0,B(9&*9K

1+AC5'!%=E(@K: 2 "1+AC5'JE?K7
6K3J.()H0J<FWebinar
"(>H7$ S PS Secure Consumer
7:/80# C2D9";47=
CH7:130 "
40 I ".K:01 1.7 ,)C847GK,"

©Akamai Technologies, 2018

DNS     ..

20%55%68%

"%.,

*0' "PRSD$#" (+)-&.

2016!2017  3 /" PRSD


Source: Nominum

8SPS ThreatAvert

Source: Nominum©Akamai Technologies, 2018

Source: Nominum+* PRSD&% "( Ratio# : 3 ' &%,! 50 &% )$ •1 

Source: Nominum Research, 2017

9SPS ThreatAvert©Akamai Technologies, 2018-*: )2'& $%!&"%&&#&%$&4+•$ 0/ 31 ,./(

IP  1 250   Source: Nominum Research, 2016 – Amplification attack traffic from 4 IPs
10SPS ThreatAvert©Akamai Technologies, 2018•: 

QPS





0 QPS to 180k QPS
in 10 minutes

Source: Nominum Data Science11

SPS ThreatAvert©Akamai Technologies, 2018



12



DDoS

©Akamai Technologies, 2018

ThreatAvert 

©Akamai Technologies, 2018

SPS ThreatAvert•LegitimateQueries– C;=?;= C&C S3EP>Q*P>Q3P=NRL) "AN;1– DNS*PB!'AN;1$MR=KF;=!%' – JP:GQ4A>H,P( PRSD / # ) "AN;1
– DNS=P?KP2"AN;1InternetStreaming
ThreatIntelligence

Akamai &@+R>(K6=CacheServe ?;=OR1Q70IK<+QDK5R)

Dashboardstreaming data

•

MDR=–

QAN;1

– >KL:-P!%'SEL-.*Q9,B1J,*
P= T
AttackQueries

14

SPS ThreatAvert–   MDR=
– /281<+AQMDR=©Akamai Technologies, 2018

DDoS(!)/ AH
*SVQW\KFXYND]\YH]L :'96%8<> 1 04> 1000 9GEYB)351?/8=@4IJNW:Legitimate
QueriesInternet
Streaming
ThreatIntelligence• PW
Dashboardstreaming data

15

SPS ThreatAvert

IM@ (anomaly) F:• RSN "*230%+4,2VQD<I>• GE=TL $4JB;• 9Z@ (false positive) CY
&Attack
Queries

7YH]L8<?A!

:KU

OXX8

- 9CMUO]P:#$8+2@ 8TZMG• DDoS 8<?RMP[]G;9(B"8, .
• (!#!14 $ ?[6
-$ '.2 75AH©Akamai Technologies, 2018

&

*.342+/'5"034"#'- (DRS)=T109O*.3?NSCNAME
IP*2#WHOIS E@>L1#)M(5%,5#<•$ /1'4,3&5G8 *.3?1#)BS7*.3?6P •,3&5N
K:,3&5N
IRUCQ

•↓•DNS!14(5%HA1#)FDJ;•©Akamai Technologies, 2018

Domain2Vec•$+G7.

!%$+

D: IP "• $ IP "I4H1#% … J•

9, DNS••<EA•)2

!$+:90'& 03?@= /6•!$

5-( %$I TLDF5-> … J••

D8B*=

©Akamai Technologies, 2018

DGA;C   OE:). 3P@;#-&"7H =I#&"'0"

PRSD 4M)%,-3$+1ACacheServe ). 3@;'$+1F9 6'$+1'0"

X<randomstring>
popularsite.com><www3>
popularsite.com>

 

1(?>5ANY.B

CacheServe ). 3 ANY ./3#2.*"#LB•!

truncate/3#2.*"# N8J .truncate <DK@;-1# TCP .#-
!(3&(GC) $/! truncate <D.
#-•••18

SPS ThreatAvert©Akamai Technologies, 2018$*? $*?

ThreatAvert 

©Akamai Technologies, 2018

%&# DNS * "*:+=&<=* (4CacheServe•

K\%"=6/7*CV]E– >X?I_Q.),:=
=0;#;1=.;,•Kafka $*) $('"*(*K`&TBRFWM– HU=* (4';&2ND)0!9=-^LZGS 78&2 DNS +=&*93,7<+=&

*!*•ThreatAvert– /)!+=&<$%*2 (SplunkHadoopY) @07"=$5;cAb
O[M20©Akamai Technologies, 2018

• 07"=$5;<1=&8• PJ/)!+=&<$%*2• @aW$%*2

   
• *3# DNS 0 – J; H\ R=X• UV  )7 DNS FC – UV !&
• 0!&6#+%7& –0!&ONSQAZ>• IP *!/(M – '#&47LKT@ G^?
 _E • '#&47:.1 – WD
8[2-7$5 ThreatAvert ,7!
]</"5!9Y21

SPS ThreatAvertB©Akamai Technologies, 2018

@6B>
(*(#0A=/• *)• DNS .").&/!
'.98 (PRSD) - QPS
" 10 '.
• %+ *:7< IP ,:• -./*B>,$0• DDoS ?;,$0 (5351)• 24 DDoS %+/'.) .
B>
22©Akamai Technologies, 2018  

*-'+,& - DNS  )72•• QPS ), * +,-• )-'+,+• ) *3/",*
 -

•+- - <9
40 ;:• (+=51)  / * +
• %&, / !
• UPD/TCP ) 23• *6CPU.98
#$).98©Akamai Technologies, 2018   •")'-(+,, #*%.
$& !-•24©Akamai Technologies, 2018!$#$  & 6
1% 50 .$"/25

$-),32(' 7*+IPv4IPv6 .

-

$ ,4$#$$

SPS ThreatAvert©Akamai Technologies, 2018

4=9&+V  DDoS MLKR^d

TNW(1;%=&'
DNS 
6*&':=<'5-& 70% Hc$62="3;

 CacheServe @ab ThreatAvert OCD

ML\P-7%]E)27<.8="3;>[I`6_A!=,#SFJ


1G
1?

XQ

26

SPS ThreatAvert €200,000 YZ #'BU €50,000 !/='<0#'BU©Akamai Technologies, 2018



©Akamai Technologies, 2018

:1

6:*4;%0-5:    2',    2',

13

 .<4% </

16:*4
%0-5:
$ 7

ISP3ISPISP 7(8 /228

SPS ThreatAvert

2<4;8<)
!<1: DNS
19#&<4:)<.+,

:)<.+,
 $ 7

ISP 7(8/2©Akamai Technologies, 2018!<1: DNS
19#&<
3+,7"<&0;$ 7    
DNS 8I5)=60H8I5H347@!
2>4/B,<!(8I5) ";I:-.*#3I@E4
Hadoop & Splunk $"'%! !(41IB=C7+
3G?D 8?F,AG9

2980 %"8I5©Akamai Technologies, 2018

The world’s largest
and most trusted
Cloud Delivery Platform©Akamai Technologies, 2018