Paper
27 March 2024 Accurate DNS server fingerprinting based on borderline behavior analysis
Botao Zhang, Chengxi Xu, Fan Shi
Author Affiliations +
Proceedings Volume 13105, International Conference on Computer Graphics, Artificial Intelligence, and Data Processing (ICCAID 2023); 131052H (2024) https://doi.org/10.1117/12.3026357
Event: 3rd International Conference on Computer Graphics, Artificial Intelligence, and Data Processing (ICCAID 2023), 2023, Qingdao, China
Abstract
Recent security incidents against the global DNS ecosystem show a close association with outdated versions of DNS servers. Attackers and security researchers widely employ server fingerprinting as a pre-exploit technique. Considering that a single active or passive fingerprinting technique is difficult to achieve accurate and effective results, we proposed a fingerprinting method combining active and passive techniques to identify different DNS servers. We record DNS server fingerprints by collecting interaction borderline behavior of different DNS servers. After that, we propose a novel hierarchical fingerprinting model named as fpdns-ng algorithm. We apply machine learning models like Decision Tree, KNN and Multilayer Perceptron to classify different kinds of DNS servers. Experiment results prove the effectiveness of our method and show that our approach is more accurate than the state-of-the-art in fingerprinting mainstream DNS servers.
(2024) Published by SPIE. Downloading of the abstract is permitted for personal use only.
Botao Zhang, Chengxi Xu, and Fan Shi "Accurate DNS server fingerprinting based on borderline behavior analysis", Proc. SPIE 13105, International Conference on Computer Graphics, Artificial Intelligence, and Data Processing (ICCAID 2023), 131052H (27 March 2024); https://doi.org/10.1117/12.3026357
Advertisement
Advertisement
RIGHTS & PERMISSIONS
Get copyright permission  Get copyright permission on Copyright Marketplace
KEYWORDS
Information security

Machine learning

Network security

Decision trees

Back to Top