Mass MailingWorm Detection by Means of Situation Aware DNS

The domain name system (DNS) is a critical infrastructural component of Internet, since it constitutes the essential first link in the entire chain of Internet connectivity. Enriching DNS functionality with in-network decision making capabilities can enable DNS to protect effectively both itself and the Internet, minimizing simultaneously human intervention. Decision making builds on the concept of situation awareness i.e. the ability of the name servers to infer a behavioural model of each host sending queries to them. We present a method for automatic behaviour classification on the name servers to detect mass mailing worm activity. Our method is based on applying spatial data mining in combination with the wavelet transform on DNS queries. We present the experimental results collected after applying our method on real DNS traffic captured at the name servers of a corporate network, which serves daily 400-500 users