Box counting–based multifractal analysis of network to detect Domain Name Server attack

摘要

Domain Name Server (DNS) is a type of server used to maintain and process the IP addresses of all the domains in the Internet. It works by responding with corresponding IP addresses when a client requests with a domain name. The DNS can be attacked by redirecting all the incoming traffic to a fake server by returning fake IP address when requested by a client. In this work, a novel work has been employed to detect DNS attack using box-counting method (BCM)-based multifractal analysis. A set of network features are selected and rules are created using CISCO's Flowspec model, and those features are analysed using BCM technique to find the attack in the network traffic. To the best of our knowledge, this is the first work that implements Flowspec-based monitoring of DNS attack using fractal analysis.