Affinito, Antonia (2023) Malicious and Large-Scale Phenomena over the Internet: An Analysis based on DNS. [Tesi di dottorato]

Anteprima

Testo affinito_antonia_35.pdf Download (14MB) | Anteprima

Abstract

Cyber security threats and real-life phenomena (e.g., COVID-19 pandemic) are increasingly reflected over the Internet. Hackers usually scan a network to discover active and vulnerable network devices prior to initiating a malicious activity. This is also the approach adopted by botnets, one of the most important, current cyber security threats. These malicious networks of bots more and more use the Domain Name System (DNS) as a tool for their operations. This thesis provides twofold contributions. The first one addresses the problem of detecting port and net scans in high-speed networks. Big Data analysis techniques are applied to cope with the large volume of data to be processed. Mirai botnet scan is also investigated. Scrutinizing its signature over a six-year period from real Internet traffic reveals the evolution of such botnet and its variants. The second contribution focuses on DNS as a good observation lens for monitoring the proper operation of the Internet. It focuses on how Internet Service Providers and public DNS resolvers protect users accessing domains associated with such activities. It also shows how the lifetime of malicious domain names may be shorter than the one of benign domains due to take-down efforts of registries. Finally, two case studies on how DNS data can be used to analyze prominent and global real-life events are reported. First, the effect of the COVID-19 pandemic restrictions on network utilization is explored, providing insights into the usage of Internet applications during this period. Second, the impact of the Ukraine conflict on Russian domain infrastructure is presented, investigating its changes before and after the start of this event.

Downloads

Actions (login required)

Modifica documento