DNS Attack Detection Based on Multi-Dimensional Fusion Model

Abstract

The domain name system (DNS) is one of the most critical infrastructures of the Internet. The lack of security consideration at the beginning of its design phase leads to an endless stream of attacks related to it, such as malware, APT, spam and botnet. Currently, most of the DNS detection methods are performed by extracting DNS package features and get the classification result by rule-based or machine learning technology. However, these methods have the problem of insufficient features extraction in large time span and limitation of single dimension detection model. In this paper. We propose a long term DNS data processing method, which extract features from DNS domain name, DNS request and DNS resolution dimension. And present WD-DNS, a DNS attack detection method based on multi-dimensional fusion model, which integrates the deep learning attack detection models of each dimension. At last, the evaluation results of our fusion model approach against independent detection model in each dimension indicates that WD-DNS model can detect DNS attack with high accuracy.