Search

Copyright of Journal of Computer Engineering & Applications is the property of Beijing Journal of Computer Engineering & Applications Journal Co Ltd. and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

Copyright of Chinese Journal of Network & Information Security is the property of Beijing Xintong Media Co., Ltd. and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

Abstract The Internet has become a vital part of our daily lives, serving as a hub for global connectivity and a facilitator for seamless communication and information exchange. However, the rise of malicious domains presents a serious challenge, undermining the reliability of the Internet and posing risks to user safety. These malicious activities exploit the Domain Name System (DNS) to deceive users, leading to harmful activities such as spreading drive-by-download malware, operating botnets, creating phishing sites, and sending spam. In response to this growing threat, the application of Machine Learning (ML) techniques has proven to be highly effective. These methods excel in quickly and accurately detecting, classifying, and analyzing such threats. This paper explores the latest developments in using transfer learning for the classification of malicious domains, with a focus on image visualization as a key methodological approach. Our proposed solution has achieved a remarkable testing accuracy rate of 98.67%, demonstrating its effectiveness in detecting and classifying malicious domains.

The Internet has become a vital part of our daily lives, serving as a hub for global connectivity and a facilitator for seamless communication and information exchange. However, the rise of malicious domains presents a serious challenge, undermining the reliability of the Internet and posing risks to user safety. These malicious activities exploit the Domain Name System (DNS) to deceive users, leading to harmful activities such as spreading drive-by-download malware, operating botnets, creating phishing sites, and sending spam. In response to this growing threat, the application of Machine Learning (ML) techniques has proven to be highly effective. These methods excel in quickly and accurately detecting, classifying, and analyzing such threats. This paper explores the latest developments in using transfer learning for the classification of malicious domains, with a focus on image visualization as a key methodological approach. Our proposed solution has achieved a remarkable testing accuracy rate of 98.67%, demonstrating its effectiveness in detecting and classifying malicious domains. [ABSTRACT FROM AUTHOR]

Encrypted domain name resolution can reduce the risk of privacy leakage for Internet users. However, it may also prevent network administrators from detecting suspicious communications. Profiling malicious and benign DNS-over-HTTPS (DoH) traffic can provide deeper insights into their behaviors, improving user activity identification and characterization. In this research, we proposed a new behavioral profiling model by selecting a method with high performance that is inherently interpretable. The inherently interpretable methods, including Linear Regression, Decision Trees (DT), and Random Forest (RF), were analyzed for understanding and providing more meaningful behavioral profiles. Based on the analysis, DT was selected to profile the malicious and benign behavior. To reduce the computational cost, improve the model performance and interpretability, and prevent overfitting issues, we introduced a novel feature engineering technique based on mutual information and the correlation coefficient between features to identify the best feature set for behavioral profiling. We also generated a public balanced dataset for analyzing the performance of the proposed profiling model, 'BCCC-CIRA-CIC-DoHBrw-2020'. This dataset is based on 'CIRA-CIC-DoHBrw-2020' which is a publicly available dataset. We utilized the SMOTE data balancing technique to generate the mentioned dataset. The experimental results showed an accuracy of 93.93% and 94.86% for the created malicious and benign profiles, respectively. [ABSTRACT FROM AUTHOR]

Domain name service (DNS) plays an important role in the Internet. The combination of ENUM technology and DNS has been widely used in the three networks convergence, and the BIND system accounts for a high rate in the DNS. This paper compares the difference between the RFC and the BIND system on the longest matching rule. By comparing the results of the two types of DNS, a dual search strategy is proposed to modify the BIND system, so that the DNS conforms to the standard RFC. This can provide ideas for more standard service customization processing, and deploy an application in the real network. [ABSTRACT FROM AUTHOR]

Domain Generation Algorithms (DGA’s) have been employed by botnet orchestrators for controlling infected hosts (bots), while evading detection by performing multiple DNS requests, mostly for non-existing domain names. With blacklists ineffective, modern DGA filtering methods rely on Machine Learning (ML). Emerging needs for higher intrusion detection accuracy lead to complex, non-interpretable black-box classifiers, thus requiring eXplainable Artificial Intelligence (XAI) techniques. In this paper, we utilize SHapley Additive exPlanation (SHAP) to derive model-agnostic, post-hoc interpretations on DGA name classifiers. This method is applied to binary supervised tree-based classifiers (e.g. eXtreme Gradient Boosting - XGBoost) and deep neural networks (Multi-Layer Perceptron - MLP) to assess domain name feature importance. SHAP visualization tools (summary, dependence, force plots) are used to rank features, investigate their effect on model decisions and determine their interactions. Specific interpretations are detailed for identifying names belonging to common DGA families pertaining to arithmetic, wordlist, hash and permutation based schemes. Learning and interpretations are based on up-to-date datasets, such as Tranco for benign and DGArchive for malicious names. Domain name features are extracted from dataset instances, thus limiting time-consuming and privacy-invasive database operations on historical data. Our experimental results demonstrate that SHAP enables explanations of XGBoost (the most accurate tree-based model) and MLP classifiers and indicates the characteristics of specific DGA schemes, commonly employed in attacks. In conclusion, we envision that XAI methods will expedite ML deployment in networking environments where justifications for black-box models are required.

In this paper, we propose an approach for detecting internal and external network scanning attacks on enterprise networks. In our approach, an inline scan detection system (SDS) monitors the ingress and egress flows of an enterprise network subnet and detects scanning probes based on the correlation of flows with preceding DNS query/responses and reducing TTL values of DNS Resource Records (RR). Through rigorous evaluation, we show that our method is effective against both external and internal port scanners and network worms, its effectiveness is independent of scanning rate or technique, and its deployment incurs negligible overhead on DNS and network response times. While the idea of detecting scans by correlating network flows with preceding DNS query/responses has been proposed in the literature, this work extends the state-of-the-art by offering four contributions: 1) we show that without decreasing TTL values of RRs in DNS responses, attackers can piggyback on cached DNS records to bypass our detection; thus we incorporate a TTL reduction mechanism to enhance the effectiveness of this approach, especially against stealthy and adaptive scanners; 2) while prior works work against internal scanners, we use the relatively new extension of DNS protocol, ENDS0 Client Subnet (ECS) option, to expand this approach toward detecting external scanners; 3) we present a novel adaptive scanning technique, called DNS-cache-based scanning, that exploits local DNS cache to bypass prior detection methods, and shows that, while prior approaches fail to defeat this threat model, our approach is effective against this evolved threat model as well; and 4) contrary to existing work that focuses on defeating fast network scanning worms, this approach is effective against any scanning, including stealthy scanning that uses conservative timing profiles to evade detection.

The Domain Name System (DNS) protocol essentially translates domain names to IP addresses, enabling browsers to load and utilize Internet resources. Despite its major role, DNS is vulnerable to various security loopholes that attackers have continually abused. Therefore, delivering secure DNS traffic has become challenging since attackers use advanced and fast malicious information-stealing approaches. To overcome DNS vulnerabilities, the DNS over HTTPS (DoH) protocol was introduced to improve the security of the DNS protocol by encrypting the DNS traffic and communicating it over a covert network channel. This paper proposes a lightweight, double-stage scheme to identify malicious DoH traffic using a hybrid learning approach. The system comprises two layers. At the first layer, the traffic is examined using random fine trees (RF) and identified as DoH traffic or non-DoH traffic. At the second layer, the DoH traffic is further investigated using Adaboost trees (ADT) and identified as benign DoH or malicious DoH. Specifically, the proposed system is lightweight since it works with the least number of features (using only six out of thirty-three features) selected using principal component analysis (PCA) and minimizes the number of samples produced using a random under-sampling (RUS) approach. The experiential evaluation reported a high-performance system with a predictive accuracy of 99.4% and 100% and a predictive overhead of 0.83 µs and 2.27 µs for layer one and layer two, respectively. Hence, the reported results are superior and surpass existing models, given that our proposed model uses only 18% of the feature set and 17% of the sample set, distributed in balanced classes. [ABSTRACT FROM AUTHOR]

Cybercriminals use domain generation algorithms (DGAs) to prevent their servers from being potentially blacklisted or shut down. Existing reverse engineering techniques for DGA detection is labor intensive, extremely time-consuming, prone to human errors, and have significant limitations. Hence, an automated real-time technique with a high detection rate is warranted in such applications. In this article, we present a novel technique to detect randomly generated domain names and domain name system (DNS) homograph attacks without the need for any reverse engineering or using nonexistent domain (NXDomain) inspection using deep learning. We provide an extensive evaluation of our model over four large, real-world, publicly available datasets. We further investigate the robustness of our model against three different adversarial attacks: DeepDGA, CharBot, and MaskDGA. Our evaluation demonstrates that our method is effectively able to identify DNS homograph attacks and DGAs and also is resilient to common evading cyberattacks. Promising results show that our approach provides a more effective detection rate with an accuracy of 0.99. Additionally, the performance of our model is compared against the most popular deep learning architectures. Our findings highlight the essential need for more robust detection models to counter adversarial learning. [ABSTRACT FROM AUTHOR]

A Local Area Network (LAN) is a private communication network for connecting computers and devices in a circumscribed location. This paper explains the design and implementation of LAN for a Hotel named 'Greenwich'. The network topology is achieved with the help of nodes such as Server, Routers, Switches, PCs, Wireless Devices, WLANs and Ethernet cables. The paper also deals with a few other topics like Server Configuration (HTTP, DNS, FTP and Email Servers), IP Address Configuration, transmission of packets among the devices in the network, working of IP phones and also how Virtual LANs can help in separating sectors in a network. All routers of all the floors are connected to the Internet. The entire network topology of Hotel Greenwich is simulated with the help of a simulating software called Cisco Packet Tracer (CPT). The implemented design is of primary level and can be enhanced for higher levels. [ABSTRACT FROM AUTHOR]

Networks not employing destination-side source address validation (DSAV) expose themselves to a class of pernicious attacks which could be prevented by filtering inbound traffic purporting to originate from within the network. In this work, we survey the pervasiveness of networks vulnerable to infiltration using spoofed addresses internal to the network. We issue recursive Domain Name System (DNS) queries to a large set of known DNS servers world-wide using various spoofed-source addresses. In late 2019, we found that 49% of the autonomous systems we tested lacked DSAV. After a large-scale notification campaign run in late 2020, we repeated our measurements in early 2021 and found that 44% of ASes lacked DSAV—though importantly, as this is an observational study, we cannot conclude causality. As case studies illustrating the dangers of a lack of DSAV, we measure susceptibility of DNS resolvers to cache poisoning attacks and the NXNS attack, two attacks whose attack surface is significantly reduced when DSAV in place. We discover 309K resolvers vulnerable to the NXNS attack and 4K resolvers vulnerable to cache poisoning attacks, 70% and 59% of which would have been protected had DSAV been in place. [ABSTRACT FROM AUTHOR]

Cyber attacks have become more sophisticated and frequent over the years. Detecting the components operated during a cyber attack and relating them to a specific threat actor is one of the main challenges facing cyber security systems. Reliable detection of malicious components and identification of the threat actor is imperative to mitigate security issues by Security Operations Center (SOC) analysts. The Domain Name System (DNS) plays a significant role in most cyber attacks observed nowadays in that domains act as a Command and Control (C&C) in coordinated bot network attacks or impersonate legitimate websites in phishing attacks. Thus, DNS analysis has become a popular tool for malicious domain identification. In this collaborative research associating Ben-Gurion University and IBM, we develop a novel algorithm to detect malicious domains and relate them to a specific malware campaign in a large-scale real-data DNS traffic environment, dubbed Identification of Malicious Domain Campaigns (IMDoC) algorithm. Its novelty resides in developing a framework that combines the existence of communicating files for the observed domains and their DNS request patterns in a real production environment. The analysis was conducted on real data from Quad9 (9.9.9.9) DNS recursive resolvers combined with malicious communicating files extracted from VirusTotal, and confirms the strong performance of the algorithm on a real large-scale data production environment.

Detecting malicious activities in cyber systems is a major challenge of cybersecurity service providers. Due to the large amount of network traffic, it is often likened to finding a needle in a haystack. Domain name system (DNS) is one of the fundamental protocols of the internet, and therefore it can give a broad view of those malicious activities, which abuse it and leave fingerprints as part of their attack vector. In this collaborative research between Ben-Gurion University, and IBM, a significant performance improvement was achieved in detecting malicious domains as compared to the state-of-the-art software solutions. Specifically, we establish a novel algorithm to detect malicious domains in large-scale DNS traffic, named Resource-Efficient Malicious Domain Detector (REMaDD), with the following desired properties. First, the algorithm does not require prior knowledge on historical malicious activities in its real-time operations. Second, the development used real live streaming data from The Inter-University Computation Center (IUCC), and operated on real-time IBM system. The algorithm is highly computational efficient and satisfies real-time requirements in terms of running time and computational complexity. REMaDD demonstrated strong performance in terms of both detection accuracy and computational efficiency as compared to existing algorithms. Specifically, experimental results on IBM production environment demonstrated that REMaDD achieved 89.4% Precision score, and 82.9% Recall score. By contrast, the DomainObserver, and LSTM.MI algorithms achieved only 76.7%, 67.2% Precision score, and 81.7%, 75.3% Recall score, respectively.

Today, cyber attacks are constantly evolving and changing, which makes them harder to detect. In particular, detecting attacks in large-scale networks is very challenging because they require high detection rates under real-time resource constraints. In this paper, we focus on detecting infected Internet of Things (IoT) hosts from domain name system (DNS) traffic data. IoT hosts, such as streaming cameras, printers, air conditioners, are hard to protect, unlike PCs and servers. Enterprises are often unaware of the devices which are connected to the network, their types, makes, and vulnerabilities. Since IoT hosts make use of the DNS protocol, analyzing DNS data can give a broad view of malicious activities, because they abuse the DNS protocol and leave fingerprints as part of their attack vector. In this collaborative research between Ben-Gurion University, and IBM, we establish a novel algorithm to detect infected IoT hosts in large-scale DNS traffic, named Anomaly and Reputation Based Algorithm (ARBA). Its novelty resides in developing a framework that combines host classification and domain reputation in a real-time production environment. ARBA is highly computational efficient and meets real-time requirements in terms of run time and computational complexity. By contrast to existing algorithms, it does not require a massive traffic volume for training, which is of significant interest in detecting infected hosts in real-time. The research was conducted on real live streaming data from IBM internal network traffic, and confirm the algorithm's strong performance in a real-time production environment.

The Domain Name System (DNS) protocol essentially translates domain names to IP addresses, enabling browsers to load and utilize Internet resources. Despite its major role, DNS is vulnerable to various security loopholes that attackers have continually abused. Therefore, delivering secure DNS traffic has become challenging since attackers use advanced and fast malicious information-stealing approaches. To overcome DNS vulnerabilities, the DNS over HTTPS (DoH) protocol was introduced to improve the security of the DNS protocol by encrypting the DNS traffic and communicating it over a covert network channel. This paper proposes a lightweight, double-stage scheme to identify malicious DoH traffic using a hybrid learning approach. The system comprises two layers. At the first layer, the traffic is examined using random fine trees (RF) and identified as DoH traffic or non-DoH traffic. At the second layer, the DoH traffic is further investigated using Adaboost trees (ADT) and identified as benign DoH or malicious DoH. Specifically, the proposed system is lightweight since it works with the least number of features (using only six out of thirty-three features) selected using principal component analysis (PCA) and minimizes the number of samples produced using a random under-sampling (RUS) approach. The experiential evaluation reported a high-performance system with a predictive accuracy of 99.4% and 100% and a predictive overhead of 0.83 µs and 2.27 µs for layer one and layer two, respectively. Hence, the reported results are superior and surpass existing models, given that our proposed model uses only 18% of the feature set and 17% of the sample set, distributed in balanced classes.

The domain name system (DNS) is a crucial component in the current IP-based Internet architecture. However, it suffers from several security vulnerabilities. This is because it does not have proper data integrity and origin authentication mechanisms. This article focuses on the typo-squatting vulnerability (a vulnerability often neglected). Typo-squatting is when attackers register a domain name that is extremely similar to an existing one to redirect users to malicious/suspicious websites. This can lead to information threats, corporate secret leakage, and can facilitate fraud. As an extension to our previous work, this work proposes ensemble-based feature selection and classification models to detect DNS typo-squatting attacks with low complexity. It is shown through experiments that the proposed framework detects the malicious/suspicious typo-squatting domains with high accuracy (above 87%). More specifically, the proposed model only loses between 0.9% and 1.5% in accuracy, 5% in precision (reaching 88%), and around 8% in recall (reaching 93%) while having a lower computational complexity given that the feature set size is reduced by more than 50%. [ABSTRACT FROM AUTHOR]

Internet applications remain exposed to pervasive Domain Name System (DNS)–based threats. Blockchain technologies provide a new way for tackling DNS vulnerability issues, and have been highlighted recently. However, traditional blockchain is still not well suited for big data applications such as DNS, because the performance of blockchain consensus greatly limits its practical adoption. In this paper, we present DagGridLedger, a sharded directed acyclic graph (DAG) blockchain that provides scalable big data architecture for trustful DNS management. To achieve this goal, DagGridLedger proposes a radical new architecture that combines blockchain sharding and DAG techniques on the DNS resolver side, thereby making it a promising solution to enhance the security and stability of large-scale DNS system. To be specific, DagGridLedger provides a blockchain structure targeting DNS application, which employs a high-performance DAG consensus algorithm named DagGrid. DagGrid consensus realizes a multi-DNS negotiation mechanism through block sharding in generating a block. With an improved asynchronous leaderless Byzantine consensus, DagGrid implements total order determination, which guarantees the trustful DNS management. Further experiments verified the performance of DagGridLedger as well as the applicability of the proposed blockchain architecture in traditional DNS. To this end, DagGridLedger consistently achieves a big data architecture for secure DNS record management, with a novel shared DAG consensus designed for high throughput. This makes DagGridLedger a promising architecture for highly secure and efficient DNS solution. [ABSTRACT FROM AUTHOR]

Purpose – The article addresses the Brazilian participation in ICANN and the interests of Brazil. As an introduction to the topic, a synthesis is presented on the DNS system, as well as on the origins, nature and role of ICANN, its structure, functioning, principles and governance mechanisms. Then, the main criticisms by the doctrine regarding the (lack of) participation of peripheral countries in ICANN are summarized. The next topic lists the groups and support organizations that have Brazilian members and presents some concrete cases analyzed within the scope of ICANN that affect Brazilian interests, including the registration of new gTLDs. Methodology/approach/design – The research has an eminently descriptive form, without neglecting the problematization of some related issues (specifically with regard to the interests of Brazil in ICANN). The theoretical framework is based on the studies of Milton Mueller and other authors (referred to in the bibliography) on internet governance. Findings – The paper identifies and describes, in a succinct and objective way, the DNS system, ICANN (its origins, its role and its operation) and what are the Brazilian interests related to it. Originality – It is a subject not yet explored in doctrine. Although there is a bibliography on the DNS, the origins, functioning, structure and especially the possible interests in Brazil in ICANN are little studied.

Almost all online services use a domain name resolution function to translate names typed by the user into numbers that computers understand. This basic, recursive function, performed in milliseconds and invisible to the user, was integrated from the beginning into the operation of Internet Service Providers (ISPs). This started to change with the advent of new players – such as Google, Cloudflare, Oracle – operating public resolvers and rendering the market more dynamic in the last decade. As more technologies are developed to increase the privacy and security of the domain name system (DNS) protocol, large internet companies with global operations appear better equipped to integrate the latest requirements and offer their services free to users and ISPs, further consolidating their position in the market. This article provides a timely analysis of the emerging trends of consolidation in the recursive DNS services market, focusing on its evolution in the last decade and discussing empirical evidence for the shifts occurring from 2016 to mid-2019. [ABSTRACT FROM AUTHOR]

Domain Name System (DNS) is an important system for the Internet communication. DNS is a system for distributed management and operation of domain names, and it is possible to associate with the resources such as IP address, instruct the destination host of the e-mail, and so on. On the one hand, it is very serious problem that the damage caused by the service of the DNS server being stopped, and stable operation of the DNS server is essential for stable operation of the Internet. DNS servers may be illegally accessed to make it target or springboard server for attacks such as Distributed Denial of Service (DDos) attacks and DNS reflector attacks. In this paper, we show the analysis of the queries received by our university DNS server. In addition, we propose the method to suppress attacks to DNS servers by deploying the system to monitor access from DNS clients and adaptively manipulating responses of queries from attackers in front of the DNS server based on the analysis. Moreover, we developed the prototype system and evaluated performance of it.

Copyright of Law, State & Telecommunications Review / Revista de Direito, Estado e Telecomunicações is the property of Grupo de Estudos em Direito das Telecomunicacoes (GETEL) and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

This paper introduces the principle of the DNS, and uses GNS3 and VirtualBox to build an experimental environment for the domain name system of private service. It also designs the experimental scheme of the DNS, and configures the WWW server and E-mail server. Using Wireshark is used to capture and analyze packets, the principle of the recursive query and iterative query is then introduced, the effects of the SOA record, NS record, A record, MX record and the principle of spoofing DNS are all explained, and the DNS work process is verified. The experiment lets the students better understand the working principle of DNS from both theory and practice. It enhances the practical ability and the comprehensive application ability of students. [ABSTRACT FROM AUTHOR]

The performance and operational characteristics of the Domain Name System (DNS) protocol are of deep interest to the research and network operations community. In this paper, we present measurement results from a unique dataset containing more than 26 billion DNS query–response pairs collected from more than 600 globally distributed recursive DNS resolvers. We use this dataset to reaffirm findings in published work and notice some significant differences that could be attributed both to the evolving nature of DNS traffic and to our differing perspective. For example, we find that although characteristics of DNS traffic vary greatly across networks, the resolvers within an organization tend to exhibit similar behavior. We further find that more than 50% of DNS queries issued to root servers do not return successful answers, and that the primary cause of lookup failures at root servers is malformed queries with invalid top-level domains (TLDs). Furthermore, we propose a novel approach that detects malicious domain groups using temporal correlation in DNS queries. Our approach requires no comprehensive labeled training set, which can be difficult to build in practice. Instead, it uses a known malicious domain as anchor and identifies the set of previously unknown malicious domains that are related to the anchor domain. Experimental results illustrate the viability of this approach, i.e., we attain a true positive rate of more than 96%, and each malicious anchor domain results in a malware domain group with more than 53 previously unknown malicious domains on average. [ABSTRACT FROM AUTHOR]

The Internet Corporation of Assigned Names and Numbers (ICANN) is involved in the cooperation with Top Level Domain Registries, under which the latter are empowered to manage specific parts of the global system of Internet domain names. The function of Registry for the .pl ccTLD is performed by a research institute - the Research and Academic Computer Network, referred to as NASK (Naukowa i Akademicka Siec Komputerowa) with its registered office in Warsaw. The function of the Registry for the .lt ccTLD is performed by the Kaunas University of Technology. The contractual relationship between ICANN and these Registries is not based on a written agreement, what makes a precise definition of the scope of competence assigned to the .pl and .lt. Registry is highly problematic in practice, because it would have to draw on a peculiar analogy to the content of written agreements concluded by ICANN with other entities, and on a thesis of the standardization of the content of legal relationships between ICANN and the Registries for ccTLDs. It seems, however, that this observation should not be linked with the existence on the part of ICANN contractor the right to perform the function of the specific domain Registry on the basis of exclusivity and the consequences arising from this fact, as the entitlement to perform the said function and correlated to it obligation of ICANN to respect this state of affairs is central to the legal relationship created between the said entities. In light of the assumption that the management of a ccTLD should be effected in the interest of the community of the country (autonomous area, a territory) a given domain pertains to, it is desirable for the content of the contractual relationship underlying the administration of .pl and .lt domain names to be strictly defined, unambiguous and publicly available to the community members. Establishing in detail and describing the content of such an obligation relationship is currently impossible, and an attempt at its reconstruction made in this article as based on the assumptions and the texts of the agreements on the administration of other ccTLDs seems to be a stopgap measure, running a high risk of error. [ABSTRACT FROM AUTHOR]

Abstract: This paper presents a comparison study between the TLS-based security for DSMIPv6 and IKEv2 when establishing Security Associations between MN and HA. The network transmission and processing costs are examined for each protocol using different authentication methods. The results show that the TLS-based solution has less computation cost and less authentication delay than IKEv2with D–H Groups 5 and 14. However, the high amount of transmitted data for certificate based authentications increases the authentication delay in low bandwidth wireless networks. [Copyright &y& Elsevier]

Abstract: The domain name system (DNS) is a crucial component of the Internet. At this time, the DNS is facing major changes such as the introduction of DNSSEC and Internationalized Domain Name extensions (IDNs), the adoption of IPv6 and the upcoming extension of new generic top-level domains. These changes can significantly impact the behavior of the DNS. This paper presents a global DNS reference model for predicting DNS traffic behavior under specific conditions. The quantitative reference model is intended to be used for analyzing “what-if” scenarios—for example, how would DNS query rates at the recursive and authoritative name servers increase if DNSSEC validation errors were to cause more ServFail responses to be sent to DNS clients? The DNS reference model takes into account all relevant components present in the DNS architecture. Real-world data from recursive resolvers is analyzed statistically in order to characterize the system variables that describe query behavior at each of the independent system components. In addition, experimental results that characterize DNS client behavior and data from the literature are used to model the behavior of authoritative name servers. The reference model is validated by comparing the model predictions with the behavior observed in real-world operations. The validation results demonstrate the accuracy of the model predictions. A what-if scenario dealing with the effect of ServFail responses on DNS traffic flow is also presented to demonstrate the applicability of the model. [Copyright &y& Elsevier]

The Domain Name System (DNS) is a critical component of the Internet. It maps domain names to IP addresses and serves as a distributed database for various other applications, including mail, Web, and spam filtering. This paper examines DNS zones in the Internet for diversity, adoption rates of new technologies, and prevalence of configuration issues. To gather data, we sweep 60% of the Internet's domains in June–August 2007 for zone transfers. Of them, 6.6% allow us to transfer their complete information. Surprisingly, this includes a large fraction of the domains deploying DNS security extensions (DNSSEC). We find that DNS zones vary significantly in size and some span many autonomous systems. Also, while anti-spam technologies appear to be getting deployed, the adoption rates of DNSSEC and IPv6 continue to be low. Finally, we also find that carelessness in handing DNS records can lead to reduced availability of name servers, e-mail, and Web servers. This also undermines anti-spam efforts and the efforts to shut down phishing sites or to contain malware infections. [ABSTRACT FROM PUBLISHER]

Abstract: This paper deals with the idea of implementing a complete network service on a chip. Herein, we propose an original design together with an efficient implementation of an authoritative domain name system (DNS) server on a Virtex 5 FPGA circuit. The proposed approach exploits the use of a hardware accelerator, MicroBlaze soft-processor cores and an adequate mapping between the DNS specifications and the hardware architecture leading to a Multi-Processor System on Chip (MPSoC). We propose new architectures by translating the DNS specifications to hardware form through the “Specification and Description Language” (SDL) tool. The proposed implementation allows significant reduction in power consumption together with significant performance and security improvement. The proposed architectures have been successfully implemented and tested on an actual network. The obtained results show a query performance improvement of around 200% with respect to the “Berkeley Internet Name Domain” (BIND) 9 server. [Copyright &y& Elsevier]