An FPGA System for Detecting Malicious DNS Network Traffic

Abstract : Billions of legitimate packets traverse computer networks every day. Unfortunately, malicious traffic also traverses these same networks. An example is traffic that abuses the Domain Name System (DNS) protocol to exfiltrate sensitive data, establish backdoor tunnels or control botnets. This paper describes the TRAPP-2 system, an extended version of the Tracking and Analysis for Peer-to-Peer (TRAPP) system, which detects BitTorrent and Voice over Internet Protocol (VoIP) traffic. TRAPP-2 is designed to detect a DNS packet, extract the packet payload, compare the data against a hash list and, if the packet is suspicious, log it for future analysis. Results show that the TRAPP-2 system captures 91.89% of DNS packets of interest under a 93.7% network load (937 Mbps). Also, as the hash list size is increased from 1,000 to 131,072,000 unique items, each doubling of the hash list size results in a mean increase of approximately 16 CPU cycles. These results demonstrate the ability of TRAPP-2 to detect traffic of interest under a saturated network load while maintaining large hash lists.
Type de document :
Communication dans un congrès
Gilbert Peterson; Sujeet Shenoi. 7th Digital Forensics (DF), Jan 2011, Orlando, FL, United States. Springer, IFIP Advances in Information and Communication Technology, AICT-361, pp.195-207, 2011, Advances in Digital Forensics VII. 〈10.1007/978-3-642-24212-0_15〉
Liste complète des métadonnées

Littérature citée [15 références]  Voir  Masquer  Télécharger

https://hal.inria.fr/hal-01569565
Contributeur : Hal Ifip <>
Soumis le : jeudi 27 juillet 2017 - 08:22:36
Dernière modification le : vendredi 1 décembre 2017 - 01:16:42

Fichier

978-3-642-24212-0_15_Chapter.p...
Fichiers produits par l'(les) auteur(s)

Licence


Distributed under a Creative Commons Paternité 4.0 International License

Identifiants

Citation

Brennon Thomas, Barry Mullins, Gilbert Peterson, Robert Mills. An FPGA System for Detecting Malicious DNS Network Traffic. Gilbert Peterson; Sujeet Shenoi. 7th Digital Forensics (DF), Jan 2011, Orlando, FL, United States. Springer, IFIP Advances in Information and Communication Technology, AICT-361, pp.195-207, 2011, Advances in Digital Forensics VII. 〈10.1007/978-3-642-24212-0_15〉. 〈hal-01569565〉

Partager

Métriques

Consultations de la notice

81

Téléchargements de fichiers

64