Journal of University of Chinese Academy of Sciences >
Diagnosis of threat degree of IP addresses based on the generalized and regularized Mahalanobis distances
Received date: 2013-12-31
Revised date: 2014-03-31
Online published: 2015-01-15
The domain name system (DNS) plays an important role in the internet, and maintaining its health and security is significant to the normal operation of the entire internet. To this end, we detect and shield the IP addresses that have potential threats to the name servers. We propose the generalized and regularized Mahalanobis distances to diagnose the threat degree of IP addresses. Both the methods efficiently solve the issue where the covariance matrix is singular. Real data analysis shows that the two proposed distances are very efficient in the diagnosis of threat degree of IP addresses.
CHAO Ting , LI Qizhai , LIU Zhuojun , SUN Cai , SUN Yungang . Diagnosis of threat degree of IP addresses based on the generalized and regularized Mahalanobis distances[J]. Journal of University of Chinese Academy of Sciences, 2015 , 32(1) : 18 -24 . DOI: 10.7523/j.issn.2095-6134.2015.01.004
[1] Wikipedia. Domain name syestem[EB/OL]. America: Wikimedia Foundation. Inc.[2014-03-20]. http://en.wikipedia.org/wiki/Domain_Name_System.
[2] Casalicchio E, Favino I N. Reference architecture, models and metrics[M/OL]. Roma: Global Cyber Security Center, (2011-07-22)[2013-10-20]. http://www.gcsec.org/sites/default/files/doc/D2%20Reference-Architecture-Models-and-Metrics.pdf.
[3] Antonakakis M, Perdisci R, Lee W,et al. Detecting malware domains at the upper dns hierarchy[C]//The 20th USENIX Security Symposium. USENIX Security'11. Berkeley: USENIX, 2011: 27-27.
[4] Mikle O, Slay K. Detecting hidden anomalies in DNS communication[C]//Casalicchio E. DNS EASY-2011. Americka: Global Cyber Security Center, 2011: 93-103.
[5] Casalicchio E, Fovino I N. The 3rd global stability, security and resiliency symposium final report[R]. Roma: Global Cyber Security Center, 2011.
[6] ICANN. Measuring the health of the domain name system, report of the 2nd annual symposium on DNS security, stability, & resiliency[R]. Kyoto: ICANN, 2010.
[7] Mockapetris P. RFC1035-domain names-implementation and specification[EB/OL]. America: Network Working Group, 1987-11, http://www.ietf.org/rfc/rfc1035.txt.
[8] Wikipedia. Mahalanobis distance[EB/OL]. America: Wikimedia Foundation Inc.[2014-03-22]. http://en.wikipedia.org/wiki/Mahalanobis_distance.
[9] Mahalanobis, Chandra P. On the generalised distance in statistics[C]//Knight P. Proceedings of the National Institute of Sciences of India. India: National Institute of Sciences of India, 1936: 49-55.
/
| 〈 |
|
〉 |