Top

Published in:

2022 | OriginalPaper | Chapter

A Study on the Use of 3rd Party DNS Resolvers for Malware Filtering or Censorship Circumvention

Authors : Martin Fejrskov, Emmanouil Vasilomanolakis, Jens Myrup Pedersen

Published in: ICT Systems Security and Privacy Protection

Publisher: Springer International Publishing

Activate our intelligent search to find suitable subject content or patents.

search-config

AI-assisted search

Off

Abstract

DNS resolvers perform the essential role of translating domain names into IP addresses. The default DNS resolver offered by an Internet Service Provider (ISP) can be undesirable for a number of reasons such as censorship, lack of malware filtering options and low service quality. In this paper, we propose a novel method for estimating the amount of DNS traffic directed at non-ISP resolvers by using DNS and NetFlow data from an ISP. This method is extended to also estimate the amount of DNS traffic towards resolvers that offer malware filtering or parental control functionality. Finally, we propose a novel method for estimating the amount of DNS traffic at non-ISP resolvers that would have been censored by ISP resolvers. The results of applying these methods on an ISP dataset shows to which extent 3rd party resolvers are chosen by users for either malware filtering or censorship circumvention purposes.

Dont have a licence yet? Then find out more about our products and how to get one now:

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

über 102.000 Bücher
über 537 Zeitschriften

aus folgenden Fachgebieten:

Automobil + Motoren
Bauwesen + Immobilien
Business IT + Informatik
Elektrotechnik + Elektronik
Energie + Nachhaltigkeit
Finance + Banking
Management + Führung
Marketing + Vertrieb
Maschinenbau + Werkstoffe
Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

inform now

Springer Professional "Technik"

Online-Abonnement

Mit Springer Professional "Technik" erhalten Sie Zugriff auf:

über 67.000 Bücher
über 390 Zeitschriften

aus folgenden Fachgebieten:

Automobil + Motoren
Bauwesen + Immobilien
Business IT + Informatik
Elektrotechnik + Elektronik
Energie + Nachhaltigkeit
Maschinenbau + Werkstoffe

Jetzt Wissensvorsprung sichern!

inform now

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

über 67.000 Bücher
über 340 Zeitschriften

aus folgenden Fachgebieten:

Bauwesen + Immobilien
Business IT + Informatik
Finance + Banking
Management + Führung
Marketing + Vertrieb
Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

inform now

previous chapter Passive, Transparent, and Selective TLS Decryption for Network Security Monitoring

next chapter RAAM: A Restricted Adversarial Attack Model with Adding Perturbations to Traffic Features

Ager, B., Mühlbauer, W., Smaragdakis, G., Uhlig, S.: Comparing DNS resolvers in the wild. IMC: ACM SIGCOMM conference on Internet measurement (2010). http://dx.doi.org/10.1145/1879141.1879144

Antunes, N., Pipiras, V., Jacinto, G.: Regularized inversion of flow size distribution. INFOCOM: IEEE Conference on Computer Communications (2019). https://doi.org/10.1109/INFOCOM.2019.8737406

Callejo, P., Cuevas, R., Vallina-Rodriguez, N., Rumin, Á.C.: Measuring the global recursive DNS infrastructure: a view from the edge. IEEE Access 7, 168020–168028 (2019). https://doi.org/10.1109/ACCESS.2019.2950325CrossRef

Cisco: Cisco Umbrella Privacy data sheet (2021). https://trustportal.cisco.com/c/dam/r/ctp/docs/privacydatasheet/security/umbrella-privacy-data-sheet.pdf

Cloudflare: 1.1.1.1 Public DNS Resolver (2020). https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver

Danish Ministry of Justice: Lov om ændring af retsplejeloven og forskellige andre love (2017). https://www.retsinformation.dk/eli/ft/201612L00192

Duffield, N., Lund, C., Thorup, M.: Properties and prediction of flow statistics from sampled packet streams. IMW: ACM SIGCOMM Internet Measurement Workshop (2002). https://doi.org/10.1145/637201.637225

Farnan, O., Darer, A., Wright, J.: Analysing censorship circumvention with VPNs via DNS cache snooping. In: IEEE Security and Privacy Workshops (SPW) (2019). http://dx.doi.org/10.1109/SPW.2019.00046

Fejrskov, M., Pedersen, J.M., Vasilomanolakis, E.: Cyber-security research by ISPs: a NetFlow and DNS anonymization policy. In: International Conference on Cyber Security And Protection Of Digital Services (2020). https://doi.org/10.1109/CyberSecurity49315.2020.9138869

10.

Florio, A.D., Verde, N.V., Villani, A., Vitali, D., Mancini, L.V.: Bypassing censorship: a proven tool against the recent Internet censorship in Turkey. In: IEEE International Symposium on Software Reliability Engineering Workshops (2014). https://doi.org/10.1109/ISSREW.2014.93

11.

Google: Your privacy (2021). https://developers.google.com/speed/public-dns/privacy

12.

Hubert, A., van Mook, R.: RFC 5452: measures for making DNS more resilient against forged answers (2009). https://datatracker.ietf.org/doc/html/rfc5452

13.

Khormali, A., Park, J., Alasmary, H., Anwar, A., Mohaisen, D.: Domain name system security and privacy: a contemporary survey. Comput. Netw. 185, 107699 (2021). https://doi.org/10.1016/j.comnet.2020.107699CrossRef

14.

Konopa, M., et al.: Using machine learning for DNS over HTTPS detection. In: European Conference on Cyber Warfare and Security (2020). http://dx.doi.org/10.34190/EWS.20.001

15.

Pearce, P., et al.: Global measurement of DNS manipulation. In: USENIX Security Symposium (2017). https://www.usenix.org/system/files/conference/usenixsecurity17/sec17-pearce.pdf

16.

Quad9: Data Privacy Policy (2021). https://www.quad9.net/privacy/policy/

17.

Radu, R., Hausding, M.: Consolidation in the DNS resolver market - how much, how fast, how dangerous? J. Cyber Policy (2019). https://doi.org/10.1080/23738871.2020.1722191

18.

Reddy.K, T., Wing, D., Patil, P.: RFC 8094: DNS over datagram transport layer security (DTLS) (2017). https://www.rfc-editor.org/rfc/rfc8094.html

19.

Roberts, H., Zuckerman, E., York, J., Faris, R., Palfrey, J.: 2010 circumvention tool usage report. The Berkman Center for Internet & Society (2010). https://cyber.harvard.edu/sites/cyber.harvard.edu/files/2010_Circumvention_Tool_Usage_Report.pdf

20.

Sivaraman, M., Kerr, S., Song, L.: DNS message fragments (2016). https://www.ietf.org/staging/draft-muks-dnsop-dns-message-fragments-00.txt

21.

Telecom Industry Association Denmark: Blokeringer (2021). https://www.teleindu.dk/brancheholdninger/blokeringer-pa-nettet/

22.

The Danish Rights Alliance: Report On Share With Care 2 (2020). https://rettighedsalliancen.dk/wp-content/uploads/2020/06/Report-On-Share-With-Care-2_Final.pdf

23.

The ICANN Security and Stability Advisory Committee (SSAC): SAC 032 - Preliminary Report on DNS Response Modification (2008). https://www.icann.org/en/system/files/files/sac-032-en.pdf

24.

Trevisan, M., Drago, I., Mellia, M., Munafò, M.M.: Automatic detection of DNS manipulations. In: IEEE International Conference on Big Data (2017). https://doi.org/10.1109/BigData.2017.8258415

25.

Yandex: Terms of use of the Yandex.DNS service (2021). https://yandex.com/legal/dns_termsofuse/

Title: A Study on the Use of 3rd Party DNS Resolvers for Malware Filtering or Censorship Circumvention
Authors: Martin Fejrskov
Emmanouil Vasilomanolakis
Jens Myrup Pedersen
Publisher: Springer International Publishing
Book: ICT Systems Security and Privacy Protection
Print ISBN: 978-3-031-06974-1

Electronic ISBN: 978-3-031-06975-8

Copyright Year: 2022
DOI: https://doi.org/10.1007/978-3-031-06975-8_7

Springer Professional

Abstract

Please log in to get access to your license.

Dont have a licence yet? Then find out more about our products and how to get one now:

Springer Professional "Wirtschaft+Technik"

Springer Professional "Technik"

Springer Professional "Wirtschaft"

Premium Partner