Characterizing Dark DNS Behavior

Security researchers and network operators increasingly rely on information gathered from honeypots and sensors deployed on darknets, or unused address space, for attack detection. While the attack traffic gleaned from such deployments has been thoroughly scrutinized, little attention has been paid to DNS queries targeting these addresses. In this paper, we introduce the concept of dark DNS, the DNS queries associated with darknet addresses, and characterize the data collected from a large operational network by our dark DNS sensor. We discuss the implications of sensor evasion via DNS reconnaissance and emphasize the importance of proactive defense when deploying darknet sensors by properly delegating reverse DNS authority. Finally, we present honeydns, a tool that complements existing network sensors and low-interaction honeypots by providing simple DNS services.