230 likes | 317 Views
Peeking Through the Cloud: Client Density Estimation via DNS Cache Probing. By: MOHEEB ABU RAJAB FABIAN MONROSE NIELS PROVOS Published Date: October 2010. What is DNS ? Why should we use Cloud Computing? What is Cache Probing? What is Botnet?. Introduction.
E N D
Peeking Through the Cloud: Client Density Estimation via DNS Cache Probing By: MOHEEB ABU RAJAB FABIAN MONROSE NIELS PROVOS Published Date: October 2010
What is DNS ? • Why should we use Cloud Computing? • What is Cache Probing? • What is Botnet?
Introduction • DNS caching Probing receive answers from DNS server for third party domains. • Cloud Computing - “Computing as a Utility” • Issues with cloud computing • Botnets -infected-hosts • Network Security – Activities design to protect your network
DNS • Domain name space consists tree of domain names. • The tree sub – divides into zones at the root zone. • The old zone ceases to authorities to the new zone.
Cloud Computing • Achieve economics of scale • Reduce spending on technology infrastructure • Reduce capital costs • Improve flexibility • Improve accessibility
Estimation Methodology • Growing security and privacy • Approach- Network services use DNS name • DNS cache probing measure the evolution of name in resolver’s cache
Experimental Evaluation • Centralized Scheduler for starting Iperf clients -Predefined serialized schedule file at each VM instance. -Schedule file contains a time stamp along with the nodes that should communicate for a single reading. * Iperf - Network testing tool to measure the network throughput between end hosts.
Relative estimation error of the number of hosts n with DNS queries per TTL
Web Metering • Website Metering - fastest and easiest way to see website ranks • No manual digging and guessing • Website Popularity is fully automated and runs right from your desktop • The strong correlation between website popularity, benefits and techniques for rank inflation
DNS rank versus Alexa rank for top 100 websites according to Alexa ranking
Alexa provides information - websites including Top sites, Internet Traffic stats and Metrics, Online reviews contact information and Related links and search • Alexa Also found some Fraudulent Inflation by - Click fraud - Direct manipulation attacks • The resolver list is sanitized to extract the “cooperative resolvers”
Botnet • Botnet is used to defined the user network by Bot master • Develop a scalable and robust infrastructure to capture & concurrently track multiple Botnets • IRC tracking, DNS Cache probing (minimal) • Must be benign – not used to infect others outside the testing environment • Analysis of measurements, structural and behavioral aspect of Botnets
Birth of Botnet • Bots are born from program binaries that infect your PC • Self-replicating worms • E-mail viruses • Shell code (scripts)
The IRC tracker (also called a drone) filters traffic and acts as a Bot to trick the IRC room to iteratively probe to find the footprint of particular Botnets • Uses DNS Probing • Acts as a spy
Conclusion • In this paper, we provide a ne technique for Internet demographics, the client population density of service. Also verifying the popularity rank of a website and estimating of botnet infection. A refined techniques for estimating botnet size with improving their benefits.