Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Survey and Analysis of DNS Filtering Components

Jonathan Magnusson

TL;DR

This survey analyzes DNS resolver filtering through three core techniques: Response Policy Zones (RPZ), Threat Intelligence Feeds (TIF), and Domain Generation Algorithm (DGA) detection. It synthesizes trends, strengths, and limitations across 2018–2023, highlighting gaps such as the sparse integration of RPZ with TIF and challenges in detecting unknown DGAs. The methodology systematically reviews 22 papers from three major databases, and the authors propose an open-source framework that combines RPZ, TIF, and DGA detection with privacy-preserving sharing and explainable AI to improve effectiveness and trust. The work provides a practical roadmap for future research and framework design aimed at more robust, transparent, and scalable DNS filtering.

Abstract

The Domain Name System (DNS) comprises name servers translating domain names into, commonly, IP addresses. Authoritative name servers hosts the resource records (RR) for certain zones, and resolver name servers are responsible for querying and answering DNS queries on behalf of their clients. Unfortunately, cybercriminals often use DNS for malicious purposes, such as phishing, malware distribution, and botnet communication. To combat these threats, filtering resolvers have become increasingly popular, employing various techniques to identify and block malicious requests. In this paper, we survey several techniques to implement and enhance the capabilities of filtering resolvers including response policy zones, threat intelligence feeds, and detection of algorithmically generated domains. We identify the current trends of each area and find missing intersections in the literature, which could be used to improve the effectiveness of filtering resolvers. In addition, we propose future work designing a framework for filtering resolvers using state-of-the-art approaches identified in this study.

Survey and Analysis of DNS Filtering Components

TL;DR

This survey analyzes DNS resolver filtering through three core techniques: Response Policy Zones (RPZ), Threat Intelligence Feeds (TIF), and Domain Generation Algorithm (DGA) detection. It synthesizes trends, strengths, and limitations across 2018–2023, highlighting gaps such as the sparse integration of RPZ with TIF and challenges in detecting unknown DGAs. The methodology systematically reviews 22 papers from three major databases, and the authors propose an open-source framework that combines RPZ, TIF, and DGA detection with privacy-preserving sharing and explainable AI to improve effectiveness and trust. The work provides a practical roadmap for future research and framework design aimed at more robust, transparent, and scalable DNS filtering.

Abstract

The Domain Name System (DNS) comprises name servers translating domain names into, commonly, IP addresses. Authoritative name servers hosts the resource records (RR) for certain zones, and resolver name servers are responsible for querying and answering DNS queries on behalf of their clients. Unfortunately, cybercriminals often use DNS for malicious purposes, such as phishing, malware distribution, and botnet communication. To combat these threats, filtering resolvers have become increasingly popular, employing various techniques to identify and block malicious requests. In this paper, we survey several techniques to implement and enhance the capabilities of filtering resolvers including response policy zones, threat intelligence feeds, and detection of algorithmically generated domains. We identify the current trends of each area and find missing intersections in the literature, which could be used to improve the effectiveness of filtering resolvers. In addition, we propose future work designing a framework for filtering resolvers using state-of-the-art approaches identified in this study.
Paper Structure (43 sections, 4 figures, 2 tables)

This paper contains 43 sections, 4 figures, 2 tables.

Table of Contents

  1. Introduction
  2. Background
  3. Name Servers
  4. Response Policy Zones
  5. Threat Intelligence Feeds
  6. Malware and Command-and-Control severs
  7. Domain Generation Algorithms
  8. Methodology
  9. Surveyed Literature
  10. Response Polizy Zone
  11. Satoh et al. 2019
  12. Spacek et al. 2019
  13. Wilde et al. 2019
  14. Jin et al. 2020
  15. Magalhaes et al. 2020
  16. ...and 28 more sections

Figures (4)

  • Figure 1: Resolver using a response policy zone.
  • Figure 2: Threat intelligence feed system.
  • Figure 3: Infected client generating domains based on current date, eventually finding the C2.
  • Figure 4: Intersection of topics