Premium
Box counting–based multifractal analysis of network to detect Domain Name Server attack
Author(s) -
Rajakumareswaran Velusamy,
Nithiyanandam Subramaniam
Publication year - 2019
Publication title -
international journal of communication systems
Language(s) - English
Resource type - Journals
SCImago Journal Rank - 0.344
H-Index - 49
eISSN - 1099-1131
pISSN - 1074-5351
DOI - 10.1002/dac.3916
Subject(s) - computer science , domain name system , ip address , multifractal system , computer network , domain name , the internet , domain (mathematical analysis) , name server , traffic analysis , computer security , process (computing) , server , fractal , operating system , mathematical analysis , mathematics
Summary Domain Name Server (DNS) is a type of server used to maintain and process the IP addresses of all the domains in the Internet. It works by responding with corresponding IP addresses when a client requests with a domain name. The DNS can be attacked by redirecting all the incoming traffic to a fake server by returning fake IP address when requested by a client. In this work, a novel work has been employed to detect DNS attack using box‐counting method (BCM)–based multifractal analysis. A set of network features are selected and rules are created using CISCO's Flowspec model, and those features are analysed using BCM technique to find the attack in the network traffic. To the best of our knowledge, this is the first work that implements Flowspec‐based monitoring of DNS attack using fractal analysis.