分析企业 DNS 流量以分类资产并追踪网络健康状况
Analyzing Enterprise DNS Traffic to Classify Assets and Track Cyber-Health
AI总结：
本文提出被动分析实时 DNS 流量的无监督聚类方法，用于识别和分类企业 DNS 资产并持续监测其健康，在两个大型组织中验证可发现百余个资产及多类攻击和配置问题。
摘要：
域名系统（DNS）是一项关键服务，能够将域名转换为 IP 地址（或反向转换）；因此，企业安全系统（例如防火墙）通常几乎不加限制地允许其通过。这使组织网络暴露于 DDoS、数据外泄和反射攻击之下，造成重大财务和声誉损失。拥有松散联合 IT 部门的大型组织（例如大学和研究机构）往往甚至不完全了解其所有 DNS 资产和漏洞，更不用说它们向外部世界暴露的攻击面了。在本文中，我们通过开发被动分析实时 DNS 流量、识别组织 DNS 资产并持续监控其健康状况的方法，来解决“DNS 盲点”问题。我们的贡献有三个方面。首先，我们对两个大型组织（一个大学校园和一个政府研究机构）在一个多月内的所有 DNS 流量进行了全面分析，并识别了递归解析器、权威名称服务器和混合 DNS 服务器等各类资产类型的关键行为画像。其次，我们开发了一种无监督聚类方法，利用识别出的行为属性对企业 DNS 资产进行分类，并证明我们的方法成功分类了两个组织中的 100 多个 DNS 资产。第三，我们的方法持续追踪组织 DNS 资产的各种健康指标，并识别出若干配置不当、数据外泄、DDoS 和反射攻击实例。我们认为，本文中的被动分析方法可以帮助企业以自动化且无风险的方式监控组织 DNS 健康。
英文摘要：
The Domain Name System (DNS) is a critical service that enables domain names to be converted to IP addresses (or vice versa); consequently, it is generally permitted through enterprise security systems (e.g., firewalls) with little restriction. This has exposed organizational networks to DDoS, exfiltration, and reflection attacks, inflicting significant financial and reputational damage. Large organizations with loosely federated IT departments (e.g., Universities and Research Institutes) often do not even fully aware of all their DNS assets and vulnerabilities, let alone the attack surface they expose to the outside world. In this paper, we address the "DNS blind spot" by developing methods to passively analyze live DNS traffic, identify organizational DNS assets, and monitor their health on a continuous basis. Our contributions are threefold. First, we perform a comprehensive analysis of all DNS traffic in two large organizations (a University Campus and a Government Research Institute) for over a month, and identify key behavioral profiles for various asset types such as recursive resolvers, authoritative name servers, and mixed DNS servers. Second, we develop an unsupervised clustering method that classifies enterprise DNS assets using the behavioral attributes identified, and demonstrate that our method successfully classifies over 100 DNS assets across the two organizations. Third, our method continuously tracks various health metrics across the organizational DNS assets and identifies several instances of improper configuration, data exfiltration, DDoS, and reflection attacks. We believe the passive analysis methods in this paper can help enterprises monitor organizational DNS health in an automated and risk-free manner.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
