论文标题
通过DNS数据分析监视企业主机的安全性
Monitoring Security of Enterprise Hosts via DNS Data Analysis
论文作者
论文摘要
企业网络的规模和复杂性正在增长，需要以不同的方式确保存在异质的连接资产。然而，几乎所有连接的资产都使用域名系统（DNS）进行地址解决方案，因此，DNS已成为攻击者秘密执行命令和控制（C＆C）通信，数据盗窃和服务中断的方便车辆。监视网络流量的企业安全设备通常允许所有DNS流量通过，因为它对于访问任何Web服务至关重要；它们充其量可以与已知恶意模式的数据库相匹配，因此对零日攻击无效。本论文的重点是利用DNS的三个高影响力网络攻击，特别是数据剥离，恶意软件C＆C通信和服务中断。我们使用从大学校园和政府研究组织收集的大数据（超过10B包）在一个6个月的时间内收集的，我们说明了这些攻击的解剖结构，训练用于自动检测此类攻击的机器，并评估其在该领域的功效。
Enterprise Networks are growing in scale and complexity, with heterogeneous connected assets needing to be secured in different ways. Nevertheless, virtually all connected assets use the Domain Name System (DNS) for address resolution, and DNS has thus become a convenient vehicle for attackers to covertly perform Command and Control (C&C) communication, data theft, and service disruption across a wide range of assets. Enterprise security appliances that monitor network traffic typically allow all DNS traffic through as it is vital for accessing any web service; they may at best match against a database of known malicious patterns, and are therefore ineffective against zero-day attacks. This thesis focuses on three high-impact cyber-attacks that leverage DNS, specifically data exfiltration, malware C&C communication, and service disruption. Using big data (over 10B packets) of DNS network traffic collected from a University campus and a Government research organization over a 6-month period, we illustrate the anatomy of these attacks, train machines for automatically detecting such attacks, and evaluate their efficacy in the field.
