Abstract
DNS resolvers perform the essential role of translating domain names into IP addresses. The default DNS resolver offered by an Internet Service Provider (ISP) can be undesirable for a number of reasons such as censorship, lack of malware filtering options and low service quality. In this paper, we propose a novel method for estimating the amount of DNS traffic directed at non-ISP resolvers by using DNS and NetFlow data from an ISP. This method is extended to also estimate the amount of DNS traffic towards resolvers that offer malware filtering or parental control functionality. Finally, we propose a novel method for estimating the amount of DNS traffic at non-ISP resolvers that would have been censored by ISP resolvers. The results of applying these methods on an ISP dataset shows to which extent 3rd party resolvers are chosen by users for either malware filtering or censorship circumvention purposes.
Funded by Telenor A/S and Innovation Fund Denmark, 2022.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
Ager, B., Mühlbauer, W., Smaragdakis, G., Uhlig, S.: Comparing DNS resolvers in the wild. IMC: ACM SIGCOMM conference on Internet measurement (2010). http://dx.doi.org/10.1145/1879141.1879144
Antunes, N., Pipiras, V., Jacinto, G.: Regularized inversion of flow size distribution. INFOCOM: IEEE Conference on Computer Communications (2019). https://doi.org/10.1109/INFOCOM.2019.8737406
Callejo, P., Cuevas, R., Vallina-Rodriguez, N., Rumin, Á.C.: Measuring the global recursive DNS infrastructure: a view from the edge. IEEE Access 7, 168020–168028 (2019). https://doi.org/10.1109/ACCESS.2019.2950325
Cisco: Cisco Umbrella Privacy data sheet (2021). https://trustportal.cisco.com/c/dam/r/ctp/docs/privacydatasheet/security/umbrella-privacy-data-sheet.pdf
Cloudflare: 1.1.1.1 Public DNS Resolver (2020). https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver
Danish Ministry of Justice: Lov om ændring af retsplejeloven og forskellige andre love (2017). https://www.retsinformation.dk/eli/ft/201612L00192
Duffield, N., Lund, C., Thorup, M.: Properties and prediction of flow statistics from sampled packet streams. IMW: ACM SIGCOMM Internet Measurement Workshop (2002). https://doi.org/10.1145/637201.637225
Farnan, O., Darer, A., Wright, J.: Analysing censorship circumvention with VPNs via DNS cache snooping. In: IEEE Security and Privacy Workshops (SPW) (2019). http://dx.doi.org/10.1109/SPW.2019.00046
Fejrskov, M., Pedersen, J.M., Vasilomanolakis, E.: Cyber-security research by ISPs: a NetFlow and DNS anonymization policy. In: International Conference on Cyber Security And Protection Of Digital Services (2020). https://doi.org/10.1109/CyberSecurity49315.2020.9138869
Florio, A.D., Verde, N.V., Villani, A., Vitali, D., Mancini, L.V.: Bypassing censorship: a proven tool against the recent Internet censorship in Turkey. In: IEEE International Symposium on Software Reliability Engineering Workshops (2014). https://doi.org/10.1109/ISSREW.2014.93
Google: Your privacy (2021). https://developers.google.com/speed/public-dns/privacy
Hubert, A., van Mook, R.: RFC 5452: measures for making DNS more resilient against forged answers (2009). https://datatracker.ietf.org/doc/html/rfc5452
Khormali, A., Park, J., Alasmary, H., Anwar, A., Mohaisen, D.: Domain name system security and privacy: a contemporary survey. Comput. Netw. 185, 107699 (2021). https://doi.org/10.1016/j.comnet.2020.107699
Konopa, M., et al.: Using machine learning for DNS over HTTPS detection. In: European Conference on Cyber Warfare and Security (2020). http://dx.doi.org/10.34190/EWS.20.001
Pearce, P., et al.: Global measurement of DNS manipulation. In: USENIX Security Symposium (2017). https://www.usenix.org/system/files/conference/usenixsecurity17/sec17-pearce.pdf
Quad9: Data Privacy Policy (2021). https://www.quad9.net/privacy/policy/
Radu, R., Hausding, M.: Consolidation in the DNS resolver market - how much, how fast, how dangerous? J. Cyber Policy (2019). https://doi.org/10.1080/23738871.2020.1722191
Reddy.K, T., Wing, D., Patil, P.: RFC 8094: DNS over datagram transport layer security (DTLS) (2017). https://www.rfc-editor.org/rfc/rfc8094.html
Roberts, H., Zuckerman, E., York, J., Faris, R., Palfrey, J.: 2010 circumvention tool usage report. The Berkman Center for Internet & Society (2010). https://cyber.harvard.edu/sites/cyber.harvard.edu/files/2010_Circumvention_Tool_Usage_Report.pdf
Sivaraman, M., Kerr, S., Song, L.: DNS message fragments (2016). https://www.ietf.org/staging/draft-muks-dnsop-dns-message-fragments-00.txt
Telecom Industry Association Denmark: Blokeringer (2021). https://www.teleindu.dk/brancheholdninger/blokeringer-pa-nettet/
The Danish Rights Alliance: Report On Share With Care 2 (2020). https://rettighedsalliancen.dk/wp-content/uploads/2020/06/Report-On-Share-With-Care-2_Final.pdf
The ICANN Security and Stability Advisory Committee (SSAC): SAC 032 - Preliminary Report on DNS Response Modification (2008). https://www.icann.org/en/system/files/files/sac-032-en.pdf
Trevisan, M., Drago, I., Mellia, M., Munafò, M.M.: Automatic detection of DNS manipulations. In: IEEE International Conference on Big Data (2017). https://doi.org/10.1109/BigData.2017.8258415
Yandex: Terms of use of the Yandex.DNS service (2021). https://yandex.com/legal/dns_termsofuse/
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2022 IFIP International Federation for Information Processing
About this paper
Cite this paper
Fejrskov, M., Vasilomanolakis, E., Pedersen, J.M. (2022). A Study on the Use of 3rd Party DNS Resolvers for Malware Filtering or Censorship Circumvention. In: Meng, W., Fischer-Hübner, S., Jensen, C.D. (eds) ICT Systems Security and Privacy Protection. SEC 2022. IFIP Advances in Information and Communication Technology, vol 648. Springer, Cham. https://doi.org/10.1007/978-3-031-06975-8_7
Download citation
DOI: https://doi.org/10.1007/978-3-031-06975-8_7
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-031-06974-1
Online ISBN: 978-3-031-06975-8
eBook Packages: Computer ScienceComputer Science (R0)