Using NetFlow to measure the impact of deploying DNS-based blacklists

Martin Fejrskov Andersen; Jens Myrup Pedersen; Emmanouil Vasilomanolakis

doi:10.1007/978-3-030-90019-9_24

Using NetFlow to measure the impact of deploying DNS-based blacklists

Martin Fejrskov Andersen^*, Jens Myrup Pedersen, Emmanouil Vasilomanolakis

^*Kontaktforfatter

Publikation: Bidrag til bog/antologi/rapport/konference proceeding › Konferenceartikel i proceeding › Forskning › peer review

2 Citationer (Scopus)

80 Downloads (Pure)

Abstract

To prevent user exposure to a wide range of cyber security threats, organizations and companies often resort to deploying blacklists in DNS resolvers or DNS firewalls. The impact of such a deployment is often measured by comparing the coverage of individual blacklists, by counting the number of blocked DNS requests, or by counting the number of flows redirected to a benign web page that contains a warning to the user. This paper suggests an alternative to this by using NetFlow data to measure the effect of a DNS-based blacklist deployment. Our findings suggest that only 38-40% of blacklisted flows are web traffic. Furthermore, the paper analyzes the flows blacklisted by IP address, and it is shown that the majority of these are potentially benign, such as flows towards a web server hosting both benign and malicious sites. Finally, the flows blacklisted by domain name are categorized as either spam or malware, and it is shown that less than 6% are considered malicious.

Originalsprog	Engelsk
Titel	Security and Privacy in Communication Networks : 17th EAI International Conference, SecureComm 2021, Virtual Event, September 6–9, 2021, Proceedings, Part I
Redaktører	Joaquin Garcia-Alfaro, Shujun Li, Radha Poovendran, Hervé Debar, Moti Yung
Antal sider	21
Vol/bind	1
Udgivelsessted	Springer, Cham
Forlag	Springer
Publikationsdato	3 nov. 2021
Sider	476-496
ISBN (Trykt)	978-3-030-90018-2
ISBN (Elektronisk)	978-3-030-90019-9
DOI	https://doi.org/10.1007/978-3-030-90019-9_24
Status	Udgivet - 3 nov. 2021
Begivenhed	International Conference, SecureComm 2021 - Virtual Event Varighed: 6 sep. 2021 → 9 sep. 2021 Konferencens nummer: 17th

Konference

Konference	International Conference, SecureComm 2021
Nummer	17th
Lokation	Virtual Event
Periode	06/09/2021 → 09/09/2021

Navn	Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering
Vol/bind	398
ISSN	1867-8211

Adgang til dokumentet

10.1007/978-3-030-90019-9_24

Blacklist_impact (13)Accepteret manuskript, 1,14 MB

AUB Link

Søg efter materialet i Aalborg Universitetsbiblioteks søgemaskine

Andre filer og links

Link to publication in Scopus

Citationsformater

Andersen, M. F., Pedersen, J. M., & Vasilomanolakis, E. (2021). Using NetFlow to measure the impact of deploying DNS-based blacklists. I J. Garcia-Alfaro, S. Li, R. Poovendran, H. Debar, & M. Yung (red.), Security and Privacy in Communication Networks: 17th EAI International Conference, SecureComm 2021, Virtual Event, September 6–9, 2021, Proceedings, Part I (Bind 1, s. 476-496). Springer. https://doi.org/10.1007/978-3-030-90019-9_24

Andersen, Martin Fejrskov ; Pedersen, Jens Myrup ; Vasilomanolakis, Emmanouil. / Using NetFlow to measure the impact of deploying DNS-based blacklists. Security and Privacy in Communication Networks: 17th EAI International Conference, SecureComm 2021, Virtual Event, September 6–9, 2021, Proceedings, Part I. red. / Joaquin Garcia-Alfaro ; Shujun Li ; Radha Poovendran ; Hervé Debar ; Moti Yung. Bind 1 Springer, Cham : Springer, 2021. s. 476-496 (Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering, Bind 398).

@inproceedings{fc15c65962b0436d98e172b9f6da44fb,

title = "Using NetFlow to measure the impact of deploying DNS-based blacklists",

abstract = "To prevent user exposure to a wide range of cyber security threats, organizations and companies often resort to deploying blacklists in DNS resolvers or DNS firewalls. The impact of such a deployment is often measured by comparing the coverage of individual blacklists, by counting the number of blocked DNS requests, or by counting the number of flows redirected to a benign web page that contains a warning to the user. This paper suggests an alternative to this by using NetFlow data to measure the effect of a DNS-based blacklist deployment. Our findings suggest that only 38-40% of blacklisted flows are web traffic. Furthermore, the paper analyzes the flows blacklisted by IP address, and it is shown that the majority of these are potentially benign, such as flows towards a web server hosting both benign and malicious sites. Finally, the flows blacklisted by domain name are categorized as either spam or malware, and it is shown that less than 6% are considered malicious. ",

keywords = "Blacklist, DNS, ISP, Ipfix, Netflow, RBL, Threat intelligence",

author = "Andersen, {Martin Fejrskov} and Pedersen, {Jens Myrup} and Emmanouil Vasilomanolakis",

year = "2021",

month = nov,

day = "3",

doi = "10.1007/978-3-030-90019-9_24",

language = "English",

isbn = "978-3-030-90018-2",

volume = "1",

series = "Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering",

publisher = "Springer",

pages = "476--496",

editor = "Joaquin Garcia-Alfaro and Shujun Li and Radha Poovendran and Herv{\'e} Debar and Moti Yung",

booktitle = "Security and Privacy in Communication Networks",

address = "Germany",

note = "International Conference, SecureComm 2021 ; Conference date: 06-09-2021 Through 09-09-2021",

}

Andersen, MF, Pedersen, JM & Vasilomanolakis, E 2021, Using NetFlow to measure the impact of deploying DNS-based blacklists. i J Garcia-Alfaro, S Li, R Poovendran, H Debar & M Yung (red), Security and Privacy in Communication Networks: 17th EAI International Conference, SecureComm 2021, Virtual Event, September 6–9, 2021, Proceedings, Part I. bind 1, Springer, Springer, Cham, Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering, bind 398, s. 476-496, International Conference, SecureComm 2021, 06/09/2021. https://doi.org/10.1007/978-3-030-90019-9_24

Using NetFlow to measure the impact of deploying DNS-based blacklists. / Andersen, Martin Fejrskov; Pedersen, Jens Myrup; Vasilomanolakis, Emmanouil.
Security and Privacy in Communication Networks: 17th EAI International Conference, SecureComm 2021, Virtual Event, September 6–9, 2021, Proceedings, Part I. red. / Joaquin Garcia-Alfaro; Shujun Li; Radha Poovendran; Hervé Debar; Moti Yung. Bind 1 Springer, Cham: Springer, 2021. s. 476-496 (Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering, Bind 398).

Publikation: Bidrag til bog/antologi/rapport/konference proceeding › Konferenceartikel i proceeding › Forskning › peer review

TY - GEN

T1 - Using NetFlow to measure the impact of deploying DNS-based blacklists

AU - Andersen, Martin Fejrskov

AU - Pedersen, Jens Myrup

AU - Vasilomanolakis, Emmanouil

N1 - Conference code: 17th

PY - 2021/11/3

Y1 - 2021/11/3

N2 - To prevent user exposure to a wide range of cyber security threats, organizations and companies often resort to deploying blacklists in DNS resolvers or DNS firewalls. The impact of such a deployment is often measured by comparing the coverage of individual blacklists, by counting the number of blocked DNS requests, or by counting the number of flows redirected to a benign web page that contains a warning to the user. This paper suggests an alternative to this by using NetFlow data to measure the effect of a DNS-based blacklist deployment. Our findings suggest that only 38-40% of blacklisted flows are web traffic. Furthermore, the paper analyzes the flows blacklisted by IP address, and it is shown that the majority of these are potentially benign, such as flows towards a web server hosting both benign and malicious sites. Finally, the flows blacklisted by domain name are categorized as either spam or malware, and it is shown that less than 6% are considered malicious.

AB - To prevent user exposure to a wide range of cyber security threats, organizations and companies often resort to deploying blacklists in DNS resolvers or DNS firewalls. The impact of such a deployment is often measured by comparing the coverage of individual blacklists, by counting the number of blocked DNS requests, or by counting the number of flows redirected to a benign web page that contains a warning to the user. This paper suggests an alternative to this by using NetFlow data to measure the effect of a DNS-based blacklist deployment. Our findings suggest that only 38-40% of blacklisted flows are web traffic. Furthermore, the paper analyzes the flows blacklisted by IP address, and it is shown that the majority of these are potentially benign, such as flows towards a web server hosting both benign and malicious sites. Finally, the flows blacklisted by domain name are categorized as either spam or malware, and it is shown that less than 6% are considered malicious.

KW - Blacklist

KW - DNS

KW - ISP

KW - Ipfix

KW - Netflow

KW - RBL

KW - Threat intelligence

UR - http://www.scopus.com/inward/record.url?scp=85120063144&partnerID=8YFLogxK

U2 - 10.1007/978-3-030-90019-9_24

DO - 10.1007/978-3-030-90019-9_24

M3 - Article in proceeding

SN - 978-3-030-90018-2

VL - 1

T3 - Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering

SP - 476

EP - 496

BT - Security and Privacy in Communication Networks

A2 - Garcia-Alfaro, Joaquin

A2 - Li, Shujun

A2 - Poovendran, Radha

A2 - Debar, Hervé

A2 - Yung, Moti

PB - Springer

CY - Springer, Cham

T2 - International Conference, SecureComm 2021

Y2 - 6 September 2021 through 9 September 2021

ER -

Andersen MF, Pedersen JM, Vasilomanolakis E. Using NetFlow to measure the impact of deploying DNS-based blacklists. I Garcia-Alfaro J, Li S, Poovendran R, Debar H, Yung M, red., Security and Privacy in Communication Networks: 17th EAI International Conference, SecureComm 2021, Virtual Event, September 6–9, 2021, Proceedings, Part I. Bind 1. Springer, Cham: Springer. 2021. s. 476-496. (Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering, Bind 398). doi: 10.1007/978-3-030-90019-9_24

Using NetFlow to measure the impact of deploying DNS-based blacklists

Abstract

Konference

Adgang til dokumentet

AUB Link

Andre filer og links

Fingeraftryk

Citationsformater