DSecO: Domain Name System (DNS) Data as a Knowledge Graph for Enhanced Security Analysis

Managing Domain Name System (DNS) records presents challenges in terms of consistency and tracking over time, which can have operational impacts, particularly on cybersecurity. In this paper, we explore the use of ontologies and knowledge graphs to facilitate DNS system audit activities. We define nine key use cases derived from real DNS operations data of a large-scale telco company and demonstrate how querying and inference techniques can address these use cases using an RDF knowledge graph structured by the DSecO vocabulary, an open-source ontology available at https://w3id.org/dseco. Overall, we demonstrate the feasibility of providing a unified view of DNS records and the practicality of explainable and shareable DNS administration rules for extended analysis and informed decision-making by NetOps and SecOps teams regarding DNS records.