Domain Name System Traffic Monitoring Solution for Threat Detection and Protection

Abstract

Nowadays, many organizations rely on the protection of firewalls to fight against attacks. However, with advanced techniques such as DNS Tunneling, attackers continue to leverage domain names for their evil intentions, which traditional firewalls show weaknesses in detecting and monitoring. Therefore, we decided to develop a DNS Traffic Monitoring system to detect and protect the organization from users’ attempts connecting to malicious domains on the Internet. Based on open-source software, the system is inexpensive but practical, scalable, and easy to deploy or maintain. Our solution aims to provide transparency and centralized management for users, network administrators, and security engineers for deep insights on the current DNS statistics of the organization as well as modifications to suit users’ requirements and needs. Moreover, implementing any security product should not affect user experience or workflow, especially a critical system like DNS. Thus, our team also strives to lessen the latency of our DNS Sinkhole server to make users feel as seamless as possible.