Deep learning based detection of DNS spoofing attack

Abstract

In this paper, we propose to use a classification model based on an artificial recurrent neural network (RNN) and a deep learning approach for DNS spoofing detection. It is proposed to use DNS data as well as TCP header and IP header data as features of the detection model. Using of IP header data, particularly, such feature as hop count is well known and widely used for IP spoofing. The main challenge is to apply these approaches to DNS spoofing detection. The aim of the research is to proof the feasibility of the proposed technique and to obtain metric values. The methodology of the research is to evaluate the deep learning model trained on the artificially synthesized dataset. The numerical results from simulations are used to evaluate the performance. The paper reports the accuracy about 70%.