DNS-based Detection of Scanning Worms in an Enterprise Network.
David Whyte, Evangelos Kranakis, Paul C. van Oorschot · 2005
Worms are arguably the most serious security threat facing the Internet. Seeking a detection technique that is both sufficiently efficient and accurate to enable automatic containment of worm propagation at the network egress points, we propose a new technique for the rapid detection of worm propagation from an enterprise network. It relies on the correlation of Domain Name System (DNS) queries with outgoing connections from an enterprise network. Improvements over existing scanning worm detection techniques include: (1) the possibility to detect worm propagation after only a single infection attempt; (2) the capacity to detect zero-day worms; and (3) a low false positive rate. The precision of this first-mile detection technique supports the use of automated containment and suppression strategies to stop fast scanning worms before they leave the network boundary. We believe that this technique can be applied with the same precision to identify other forms of malicious behavior within an enterprise network including: mass-mailing worms, network reconnaissance activity, and covert communications. Currently, it is unclear if our DNS-based detector will work for all network protocols. In some network environments, the DNS detection technique may need to be used as a secondary input to a more sophisticated anomaly detector.