Detection of Domain Name System Cache Attack Based on Cumulative Sum Algorithm
Lei Fan · Jisuanji gongcheng · 2011
Aiming at the Domain Name System(DNS) attack,this paper proposes a simple and robust detection mechanism.The core of this mechanism is based on the inherent DNS protocol behaviors and applies an instance of change point detection algorithm to detect attack behavior.To make the detection mechanism insensitive to attack and low computational complexity,based on the nonparametric Cumulative Sum(CUSUM) algorithm,it makes some improvements in view of DNS protocol behavior.Simulation results show the mechanism can detect the DNS attack,it makes good compromise between the detection rate and the false alarm rate.