Previous [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12]

Journal of Information Science and Engineering, Vol.18 No.6, pp.999-1009 (November 2002)

A Distributed Intrusion Detection Model
for the Domain Name System

Chang-Sheng Chen, Shian-Shyong Tseng
and Chien-Liang Liu

Department of Computer Science and Information Science
National Chiao Tung University
Hsinchu, 300 Taiwan

We have investigated the problem of detecting DoS-like DNS anomalies in DNS system. In this paper, we propose a distributed Two-phase DNS anomaly detection model for solving the problem. Three sets of algorithms corresponding to different configurations are proposed, including one sequential algorithm and two distributed algorithms, each with an increasing level of parallelism. The complexity of these algorithms have been found to be O (n logn). The distributed algorithms show at least a constant (1-1/Ck), Ck >1, improvement over the sequential one. To evaluate the performance, we have implemented the algorithms and applied them to a number of examples. The experimental result shows a speed up of about 1.68 on the test example for running on an enhanced distributed architecture with C-IDS over the sequential one. A higher speedup might be common because DNS anomalies will make the traffic distribution more concentrated on the outliers, and the computation will usually converge much more quickly.

Keywords: DoS, DNS, distributed two-phase DNS anomaly detection, IDS, two-phase anomaly detection algorithm

Full Text () Retrieve PDF document (200211_08.pdf)

Received September 13, 2001; accepted April 15, 2002.
Communicated by Jang-Ping Sheu, Makoto Takizawa and Myongsoon Park.