Protecting the DNS infrastructure of a top level domain: Real-time monitoring with network sensors

In this paper we propose a solution to strengthen the security of domain name system (DNS) servers associated with one or more top level domains (TLD). The proposed solution has been developed and tested at FCCN, the TLD manager for the .PT domain. Through the implementation of network probes that monitor the network in real-time, we are able to dynamically prevent, detect or limit the scope of attempted intrusions or other types of attacks to the DNS service. The platform relies heavily on cross-correlation allowing data from a particular sensor to be shared with the others. Administration tasks such as setting up alarms or performing statistical analysis are made through a Web-based interface.