Thursday 13 March 2025
The internet’s domain name system (DNS) is a critical infrastructure that allows us to access websites and online services by translating human-readable addresses into IP addresses. However, DNS has long been vulnerable to attacks that can redirect users to malicious sites or disrupt internet traffic. A new paper presents a novel approach to detecting and mitigating these types of attacks.
The researchers developed a system called DNS Cache Poisoning Mitigation (DNS-CPM), which is designed to integrate with intrusion prevention systems (IPS) to detect and block DNS poisoning attacks. These attacks occur when an attacker injects false information into a DNS resolver’s cache, causing it to return the wrong IP address for a target domain name.
DNS-CPM uses a combination of three simple rules to detect these types of attacks. The first rule checks for packets that have been truncated or fragmented, which can be a sign of malicious activity. The second rule looks for packets with unusual timing patterns, which may indicate an attack is underway. The third rule verifies that the domain name in question is within the bounds of the DNS system’s bailiwick rules.
The researchers tested DNS-CPM using real-world traffic data and found that it was able to detect all of the DNS poisoning attacks they simulated, with zero false positives or negatives. They also compared their approach to existing tools, such as Suricata and Snort, and found that DNS-CPM completed its tasks much faster and used less memory.
The key innovation behind DNS-CountMin Sketch (CMS), which is a probabilistic data structure used by DNS-CPM, is its ability to efficiently count the frequency of domain names in a stream of packets. This allows the system to quickly identify patterns that may indicate an attack is underway.
DNS-CPM has several advantages over existing approaches to detecting and mitigating DNS poisoning attacks. For one, it is more accurate and efficient than existing tools. It also provides better protection against advanced attacks that can evade detection by traditional intrusion prevention systems.
The researchers believe that their approach could be used to improve the security of DNS resolvers around the world, which would have a significant impact on internet security as a whole. By integrating DNS-CPM with IPS systems, network operators could provide more effective protection against DNS poisoning attacks and other types of malicious activity.
In addition to its potential impact on internet security, DNS-CPM also highlights the importance of probabilistic data structures like CountMin Sketch in modern computing.
Cite this article: “Novel Approach to Detecting and Mitigating DNS Poisoning Attacks”, The Science Archive, 2025.
Dns, Internet Security, Domain Name System, Dns Poisoning Attacks, Intrusion Prevention Systems, Probabilistic Data Structures, Countmin Sketch, Ip Addresses, Network Operators, Malicious Activity
