BSidesSF 2015 - DNS Spikes, Strikes, and The Like (Thomas Mathew)

## Overview Thomas Mathew, a researcher at OpenDNS specializing in pattern recognition and signals intelligence, presents a methodology for identifying malicious DNS activity—particularly exploit kits—using recursive DNS traffic analysis. OpenDNS operates 24 resolvers worldwide processing ~50 billion queries daily, providing rich signal data that complements traditional passive DNS approaches.

## Motivation & Problem Context Passive DNS effectively catches fast flux servers and DGA domains but fails against modern threats including compromised domains and exploit kits. Exploit kits, the primary source of botnet and spam infections, use distributed domain chains (rotators, routers, dropper pages) that operate for only hours or days. OpenDNS needed a faster detection method analyzing client query behavior patterns.

## Technical Methods **Spike Detection Algorithm**: Analyzes consecutive hours of recursive DNS traffic, counting queries per domain per hour-slice and filtering high-traffic domains (CDNs, major services). This initial pass yields ~20,000 spiking domains per 2-hour window—too much noise for manual analysis.

**K-means Clustering**: The team applied K-means with four primary features: query counts (33% importance), unique IPs (20%), resolver distribution (13%), and RCode distribution. A Fano factor metric was added to measure query volatility over time, capturing historical patterns. Data underwent z-score normalization. The elbow method determined optimal cluster count at 12. Principal Component Analysis identified relative feature contribution.

## Key Technical Challenges Count data (discrete DNS queries) naturally follows Poisson or negative binomial distributions, not the Gaussian distribution assumed by K-means. The team acknowledged this mismatch but proceeded pragmatically rather than rewriting algorithms, noting this as a caveat for future improvement. Curse of dimensionality required limiting features to those providing maximum information gain. Ground truth—determining which domains are malicious—remained a fundamental blocker; unsupervised learning served as a pre-classification exploration step.

## Results Clustering successfully separated diverse traffic patterns: benign mail servers spiking predictably hourly, DNS amplification attacks (DoS/spam) with spikes reaching 3,000 queries per hour versus typical exploit kits at 0–200, WordPress brute-force attempts, and mass Tumblr access events. Most significantly, the team identified exploit kit clusters and discovered domain shadowing attacks, such as "escort La Bersa," where malicious subdomains were injected via registrar compromise. This seeded discovery of broader registrar vulnerabilities beyond GoDaddy.

## Key Takeaways Recursive DNS patterns provide a fast, complementary channel to passive DNS for identifying emerging threats. Clustering combined with passive DNS seeding enables discovery of entire malicious infrastructure. The approach demonstrates practical threat detection value despite acknowledged limitations in statistical assumptions. Unsupervised learning proved essential for understanding ground truth before building supervised classifiers.