MULTIBASED CLOUD MONITORING OF DNS TRAFFIC FOR OPERATIVE CORRECTION OF CURRENT RPZ PARAMETERS

DOI: 10.31673/2409-7292.2025.031949

Abstract

The paper presents the results of test studies of a software tool (ST) for monitoring the current state of a defined
group of DNS servers. To improve the informative content and timeliness of test measurement data analysis, artificial
intelligence (AI) capabilities are integrated, enabling flexible adjustment of test structures and profiles. The improved ST
increases situational awareness regarding security threats in DNS traffic. The experimental version implements cloudbased multi-source measurements using spatially distributed cloud sensors, centrally controlled via an administrator
console. This architecture allows monitoring DNS query processing parameters from simulated clients located in different
domain zones. Within the framework of simulation modeling for various DNS query encryption protocols, the parameters
of the daily availability of servers were evaluated. The results confirmed the system’s ability to automatically adapt
measurement parameters and structure based on real-time AI analytics of previous observations. The generalization of
the obtained information has made it possible to identify promising directions for further improvement of the implemented
concept, including: enhancing the administrative procedures of the cloud bot-testers system; refining the specifics inherent
to different AI systems in accordance with the monitoring tasks performed; formalizing criteria for assessing the current
state of DNS traffic; improving precedent-based analysis mechanisms for detecting anomalous traffic; enhancing the
procedures for synthesizing new scenarios to detect previously unknown threats exploiting DNS traffic (services and
applications) vulnerabilities.
Keywords: DNS, RPZ, AI, information security, traffic filtering.

References
1. Chepel, D., & Malakhov, S. (2024). Uzahalnennia napriamiv filtratsii DNS trafiku yak skladovoi bezpeky
suchasnykh informatsiinykh system [Summary of DNS traffic filtering trends as a component of modern information
systems security]. Computer Science and Cybersecurity, (1), 6–21. https://doi.org/10.26565/2519-2310-2024-1-01 [in
Ukrainian].
2. Chepel, D., & Malakhov, S. (2025). Multyprotokolnyi monitorynh trafiku DNS, yak osnova dlia koryhuvannia
potochnykh parametriv RPZ [Multiprotocol monitoring of DNS traffic as a basis for adjusting current RPZ parameters].
ΛΌΓOΣ. Collection of Scientific Papers, 242–246. https://doi.org/10.36074/logos-24.01.2025.049 [in Ukrainian].
3. Korobeinykova, T., & Fedchuk, T. (2024). Ohliad protokoliv DNS, DoH ta DoT [Overview of DNS, DoH and
DoT protocols]. ΛΌΓOΣ. Collection of Scientific Papers, 253–256. https://doi.org/10.36074/logos-01.03.2024.056 [in
Ukrainian].
4. Google. (n.d.). Gemini Developer API. https://ai.google.dev/gemini-api/docs
5. Haneef, A. (n.d.). On the scalable generation of cyber threat intelligence from passive DNS streams.
http://surl.li/phbham
6. Korte, K. (n.d.). Measuring the quality of open source cyber threat intelligence feeds. http://surl.li/yhiqoe
7. Li, V. G., Dunn, M., Pearce, P., McCoy, D., Voelker, G. M., Savage, S., & Levchenko, K. (2019). Reading the
tea leaves: A comparative analysis of threat intelligence. USENIX Security Symposium, 851–867. https://atc.usenix.org/
system/files/sec19fall-li_prepub.pdf
8. Alieyan, K., ALmomani, A., Manasrah, A., & Kadhum, M. M. (2015). A survey of botnet detection based on
DNS. Neural Computing and Applications, 28(7), 1541–1558. https://doi.org/10.1007/s00521-015-2128-0
9. Choi, H., Lee, H., Lee, H., & Kim, H. (2007). Botnet detection by monitoring group activities in DNS traffic.
7th IEEE International Conference on Computer and Information Technology (CIT 2007), 715–720. https://doi.org/
10.1109/CIT.2007.90
10. Zhao, D., Traore, I., Sayed, B., Lu, W., Saad, S., Ghorbani, A., & Garant, D. (2013). Botnet detection based
on traffic behavior analysis and flow intervals. Computers & Security, 39, 2–16. https://doi.org/10.1016/
j.cose.2013.04.007
11. Lyu, M., Gharakheili, H. H., & Sivaraman, V. (2022). A survey on DNS encryption: Current development,
malware misuse, and inference techniques. ACM Computing Surveys, 55(8), 1–28. https://doi.org/10.1145/35473
12. Lu, C., Liu, B., Li, Z., Hao, S., Duan, H., Zhang, M., Leng, C., Liu, Y., Zhang, Z., & Wu, J. (2019). An endto-end, large-scale measurement of DNS-over-encryption: How far have we come? Proceedings of the ACM Internet
Measurement Conference (IMC '19), 22–35. https://doi.org/10.1145/3355369.3355580
13. Siby, S., Juarez, M., Diaz, C., Vallina-Rodriguez, N., & Troncoso, C. (2020). Encrypted DNS – Privacy? A
traffic analysis perspective. Proceedings of the 27th Network and Distributed System Security Symposium (NDSS).
https://arxiv.org/abs/1906.09682
14. Connery, H. M. (n.d.). DNS response policy zones history, overview, usage and research.
https://www.dnsrpz.info/RPZ-History-Usage-Research.pdf
15. Ichise, H., Jin, Y., & Iida, K. (2023). Policy-based detection and blocking system for abnormal direct outbound
DNS queries using RPZ. Proceedings of the 22nd International Symposium on Communications and Information
Technologies (ISCIT) ,1–6. https://ieeexplore.ieee.org/document/10376042
16. Patsakis, C., & Casino, F. (2019). Exploiting statistical and structural features for the detection of domain
generation algorithms. Journal of Information Security and Applications, (Preprint). https://arxiv.org/pdf/1912.05849
17. Koh, J. J., & Rhodes, B. (2018). Inline detection of domain generation algorithms with context-sensitive word
embeddings. In Proceedings of the 2018 IEEE International Conference on Big Data, 2966–2971. https://ieeexplore.ieee.
org/document/8622066
18. Kumar, A. D., Thodupunoori, H., Vinayakumar, R., Soman, K. P., Poornachandran, P., Alazab, M., &
Venkatraman, S. (2019). Enhanced domain generating algorithm detection based on deep neural networks. Companion
Proceedings of The 2019 World Wide Web Conference, 189–196. https://doi.org/10.1145/3308558.3316498
19. Google Cloud. (n.d.). Gemini 2.0 Flash. https://cloud.google.com/vertex-ai/generative-ai/docs/models/gemini/
2-0-flash#2.0-flash
20. Relevance AI. (n.d.). Explore the capabilities of Gemini 2.0 Flash. https://relevanceai.com/llmmodels/explore-gemini-2-0-flash-capabilities
21. Chepel, D. O. (2024). Analiz suchasnykh metodiv i tekhnolohii DNS filtratsii trafiku, yak skladovoi bezpeky
suchasnykh informatsiinykh system [Analysis of modern DNS traffic filtering methods and technologies as part of the
security of modern information systems] (Master’s thesis, V. N. Karazin Kharkiv National University). [in Ukrainian].