Xiaodong Lee

A new statistical approach to DNS traffic anomaly detection

In this paper, we describe a new statistical approach to detect traffic anomalies in the Domain Name System (DNS). By analyzing real-world DNS traffic data collected at some large DNS servers both authoritative and local, we find that normally the DNS traffic follows Heaps law in dual ways. Then we utilize these findings to characterize DNS traffic properties under normal network conditions. Based on these properties, we make estimations for the traffic of forthcoming. If the forthcoming traffic actually varies a lot with our estimations, then we can infer that some anomaly happens. Our approach is simple enough and can work in real-time. Experiments on both real and simulated DNS traffic anomalies show that our approach can detect most of the common anomalies in DNS traffic effectively.

Performance study of the dual-stack mobile IP protocols in the evolving mobile internet

The transition from IPv4 to IPv6 is an inexorable trend in the development of Internet. However, since IPv4 has been widely deployed for many years, it is mandatory that the existing IPv4 and the newly deployed IPv6 coexist and interoperate seamlessly. With the study of various mechanisms proposed for the interoperability between IPv4 and IPv6, some mobility management protocols are also extended to work in the mixed mobile Internet. In this study, the authors carry out an in-depth analysis of three types of standardised mobility management protocols with dual-stack support. Owing to the difference of underlying basic protocols, their individual dual-stack extensions have different features and thus are suited for deployment in different scenarios and stages in the evolution of the mobile Internet.

Detecting DDoS attack towards DNS server using a neural network classifier

With the rapid growth of the distributed denial of service (DDoS) attacks, the identification and detection of attacks has become a crucial issue. In this paper we present a neural network approach to detecting the DDoS attacks towards the domain name system. A multilayer feed-forward neural network is employed as a classifier based on the selected features that reflect the characteristics of DDoS attacks. The performance and the computational efficiency of the neural network classifier are both evaluated.

In-Field Attack Proof of Injected False Data in Sensor Networks

In a large-scale sensor network individual sensors can be compromised to inject bogus sensing reports. While SEF can filter out the outfield false reports, it is incapable of detecting the in-field compromised nodes, which may collect sufficient number of keyed message authentication codes (MAC). An in-field attack proof mechanism is presented in this paper. The MAC delivery mechanism makes the MACs follow the direction of increasing signal strength, and the skipping out mechanism helps the MACs walk out of the compromised nodes. As the report is forwarded, each node along the way verifies the correctness of the MACs probabilistically and drops those with invalid MACs. As the in-field compromised node is prevented from gathering enough MACs, the report generated by it can be detected and dropped en-route. Analysis and simulation show that IAP can drop bogus reports injected by an in-field compromised node in many cases.

Enhanced HMIPv6 with cascaded tunnel

Hierarchical Mobile IPv6 (HMIPv6) is designed to reduce the handover latency and signaling load of Mobile IPv6 (MIPv6). However, HMIPv6 only improves local mobility performance while the handover latency in the inter-Mobility Anchor Point (MAP) handover is still long and packet transmission cost is still heavy due to the overlapped tunnels. In this paper, we propose a cascaded tunnel scheme in HMIPv6 to reduce its handover latency and signaling cost. In the proposed scheme, the home registration of Mobile Node (MN) is conducted by the MAP in a network-based manner and the global tunnel is established between MAP and Home Agent (HA), which allows the MN to originate only the local registration signaling even during its inter-MAP handover. The improvements contributed by the proposed scheme over the basic HMIPv6 are shown to be significant from the analyzing results.

Co-training based semi-supervised Web spam detection

Traditional Web spam classifiers use only labeled data (feature/label pairs) to train. Labeled spam instances, however, are very difficult, expensive, or time consuming to obtain, as they require the efforts of experienced human annotators. Meanwhile unlabeled samples are relatively easy to collect. Semi-supervised learning addresses the classification problem by using large amount of unlabeled data, together with the labeled data, to build better classifiers. This paper proposes two new semi-supervised learning algorithms to boost the performance of Web spam classifiers. The algorithms integrate the traditional co-training with the topological dependency based hyperlink learning. The proposed methods extend our previous work on self-training based semi-supervised Web spam detection. The experimental results with 100/200 labeled samples on the standard WEBSPAM-UK2006 benchmark showed that the algorithms are effective.

Investigating sequential patterns of DNS usage and its applications

DNS is an important infrastructure of the Internet whose smooth operation and performance are vital to both the Internet users and applications. In this paper, we investigate the DNS usage patterns by applying the mixture of Markov chains (MMC) to DNS usage data. Results on cluster analysis of real DNS query data demonstrate that the method is capable of revealing insightful patterns of sequential activities of DNS users. Furthermore, typical DNS user groups are investigated. Finally, two particular application scenarios of user clustering using this method are proposed, which might help improve the DNS performance by adding plug-ins into the DNS server software.

Measuring Internet Growth from DNS Observations

Many people want to know how the Internet grows. However, it is hard to answer, especially for the huge Internet today. In this paper, a new choice for the Internet growth measurement is introduced. As a fundamental component of the modern Internet, the Domain Name System (DNS) contains plenty of information about the Internet. By performing a longitudinal evolution analysis on the DNS traffic sampled at .cn name servers between the year 2006 and 2009, we take an investigation of a long term characteristics of DNS traffic evolution, from which we believe that the Internet growth especially in China can be learned. So far, no publication has been found working on this. We find that, during these years, DNS traffic has suffered a great growth and IPv6 applications are becoming more prevalent. While DNS client population has doubled, the fraction for China is going down, indicating that the Internet in China today is becoming more internationalized. Number of domains in registry has grown 12 times from 2006, while most queries are sourced from little fraction of clients visiting similarly little fraction of domains. Domains’ access counts keep a Zipf-like distribution, but with different popularity indexes. Although our works are not perfect enough and still need to do more, we believe that our work can give good insight for the Internet growth in China.

Dealing with temporary domain name issues in the DNS

Recently, a new type of domain names, namely temporary domain names, has become heavily used by many kinds of Internet services, such as cloud storage and social networks. Generally, these services would generate a large volume of temporary domain names within their private domain zones, and use them to convey “one-time-signals” with their customers. By analyzing the real world DNS traffic, we find that over 40% of observed domain names from the Internet are temporary. While this creative usage of temporary domain names could benefit many Internet services, it may also cause some unanticipated (even negative) consequences to the DNS infrastructure. In this paper, we first describe the critical features of temporary domain names and present our observation results of their pervasiveness based on real world DNS traces collected from some major ISP. Then we verify and analyze quantitatively the negative impact that temporary domain names would cause on the DNS, especially on the DNS caching functionalities. To solve this problem, we finally introduce segmented caching strategies into the DNS cache, and further validate its capability for ensuring the effectiveness of DNS caching when facing the temporary domain name problems.

A Novel DMM Architecture Based on NDN

The unprecedented expansion of mobile Internet traffic has resulted in the development of distributed mobility management architecture. In this paper, based on Named Data Networking (NDN), traditional mobility support services are distributed among multiple anchor points in the IPv6 core network, to overcome some of the major limitations of centralized IP mobility management solutions.