Identificando comportamentos agressivos de resolvedores DNS através de aprendizado de máquina não supervisionado

Abstract

The Domain Name System (DNS) is a fundamental component of the Internet infrastructure. It allows users to easily access website resources using memorable and human-readable names. The proper functioning of DNS requires extensive use of caching in order to reduce latency, improve system resilience against DDoS attacks, and reduce Internet traffic. However, the DNS has been repeatedly abused for recursive DNS resolvers that generate excessive queries to the DNS infrastructure misuse precious resources of authoritative nameservers, possibly for no useful purpose. This work presents a method that allows classifying, quantifying and identifying who and how these DNS resolvers with abusive behavior are characterized through the use of an unsupervised learning algorithm that performs the clustering of resolvers according to their behavior. This research used the Gaussian Mixture Models algorithm to group the recursives according to the chosen attributes. The results obtained in this dissertation demonstrate that it was possible to identify four groups of recursive resolvers with different characteristics and amounts of components. For the 5 years of the analyzed DITL datasets, it was possible to conclude that the most aggressive recursives, which therefore deserve more attention and study, correspond to 2.19 up to 3.18% of the total resolvers and were responsible for 85.62 up to 94.35% of the total queries received by root servers.