Improving Smart Home Network Security via Blocking Malicious DNS Queries

The last two decades have witnessed the rapid growth of heterogeneous Internet-connected devices in smart homes, which have increasingly become a critical component of the overall Internet ecosystem. However, the diverse nature of these devices with weak security management presents substantial challenges in security and privacy. Many smart home devices fall victim to compromise, subsequently becoming part of botnets exploited by malicious attackers to launch cyberattacks towards other victims. In this paper, we characterize the remote hosts and domains the smart home devices have been communicating with, and more importantly detect if and when these devices communicate with known malicious hosts and domains. Furthermore, we design, implement, and deploy a malicious DNS query blocker system based on the efficient Bloom filter data structure to filter and block outgoing network traffic toward these known malicious hosts and domains, thereby improving the security of smart home networks and the connected devices.