Efforts are underway to add security to the DNS protocol. We have observed that if BIND would just do what the DNS specifications say it should do, stop crashing, and start checking its inputs, then most of the existing security holes in DNS as practiced would go away. To be sure, attackers would still have a pretty easy time co-opting DNS in their break-in attempts. Our aim has been to get BIN...

China’s Great Firewall passively inspects network traffic and disrupts unwanted communication by injecting forged DNS replies or TCP resets. We attempted to comprehensively examine the structure of the DNS injector, using queries from both within and outside China. Using these probes, we were able to localize the DNS monitors’ locations, extract the firewall’s DNS blacklist of approximately 15,...

This document specifies how DNS resource records are named and structured to facilitate service discovery. Given a type of service that a client is looking for, and a domain in which the client is looking for that service, this mechanism allows clients to discover a list of named instances of that desired service, using standard DNS queries. This mechanism is referred to as DNS-based Service Di...

44 COPUBLISHED BY THE IEEE COMPUTER AND RELIABILITY SOCIETIES ■ 1540-7993/09/$26.00 © 2009 IEEE ■ SEPTEMBER/OCTOBER 2009 T he Domain Name System (DNS) 1 is the Internet’s de facto name resolution system. In fact, almost every transaction performed on the Internet is prefaced by a DNS lookup—for example, when a user types “www.bankofamerica.com” into his or her Web browser, it issues a DNS reque...

The role of direct numerical simulations (DNS) of multiphase flows, where all continuum length and time scales are fully resolved, in validation and verification of models for the average flow, is discussed. Although DNS are usually limited to relatively small problems and are generally impractical for predictions of full-scale multiphase systems, DNS offer unprecedented data and insight. Indee...

In recent years Internet miscreants have been leveraging the DNS to build malicious network infrastructures for malware command and control. In this paper we propose a novel detection system called Kopis for detecting malware-related domain names. Kopis passively monitors DNS traffic at the upper levels of the DNS hierarchy, and is able to accurately detect malware domains by analyzing global D...

The Domain Name System (DNS) is a hierarchical naming system that is built on a distributed database for computers, services, or any other resource connected to the Internet or a private network. It translates the domain names meaningful to humans into the numerical identifiers associated with the networking equipment for the purpose of locating and addressing these devices worldwide[1]. The jo...

The Domain Name System (DNS) is a hierarchical and distributed database used to resolve domain names into IP addresses. The current Web infrastructure heavily relies on the DNS service to allow endusers to access Web pages and Web data using meaningful names (like “www.verisign.com”) rather than cryptic sequences of numbers (e.g., “69.58.181.89”). The main functionalities of the DNS have been s...

Extensions to the Domain Name System (DNS) are described that provide data integrity and authentication to security aware resolvers or applications through the use of cryptographic digital signatures. These digital signatures are included in secured zones as resource records. Security can still be provided even through non-security aware DNS servers in many cases. The extensions also provide fo...

44 COPUBLISHED BY THE IEEE COMPUTER AND RELIABILITY SOCIETIES ■ 1540-7993/09/$26.00 © 2009 IEEE ■ SEPTEMBER/OCTOBER 2009 T he Domain Name System (DNS) 1 is the Internet’s de facto name resolution system. In fact, almost every transaction performed on the Internet is prefaced by a DNS lookup—for example, when a user types “www.bankofamerica.com” into his or her Web browser, it issues a DNS reque...