From billion queries to action: how DNS4EU transforms threat defence

From billion queries to action: how DNS4EU transforms threat defence

Speakers: Sebastian Garcia (Czech Technical University); Tigran Oganesian (Czech Technical University)

Conference: Virus Bulletin

YouTube: https://www.youtube.com/watch?v=bcbIuChMEYM

Overview

This talk, presented by Sebastian Garcia from the Stratosphere Laboratory at the Czech Technical University in Prague, delves into the monumental challenge of securing DNS4EU, the European Union's ambitious DNS resolution infrastructure. Co-authored with Tigran Oganesian, the presentation outlines the methodologies and architectural decisions behind detecting novel malicious domains within an unprecedented scale of DNS traffic. The core objective is to identify "new" threats—those not yet cataloged by existing threat intelligence—amidst billions of daily queries.

The DNS4EU project represents a significant strategic initiative by the EU to ensure digital sovereignty and privacy for its citizens. Designed to serve 100 million users, it processes an astounding 1.2 billion DNS queries daily. This scale, coupled with strict privacy requirements that anonymize client IP addresses, creates a unique and formidable environment for threat detection. Garcia's team is tasked specifically with the security component, focusing on identifying sophisticated malware command and control (C2), data exfiltration, botnets, and spyware infrastructure, rather than common threats like phishing or Distributed Denial of Service (DDoS) attacks handled by other specialized groups.

The importance of this work cannot be overstated. By establishing an EU-controlled, privacy-preserving DNS service, DNS4EU aims to prevent EU citizens' internet traffic from being routed and potentially exploited by private entities outside the Union's regulatory oversight. The ability to autonomously and effectively detect emerging threats within this vast ecosystem is critical to fulfilling DNS4EU's promise of a secure and sovereign internet experience for Europeans. The talk provides a deep dive into the technical solutions, including advanced machine learning and Bayesian inference, developed to tackle this high-stakes security problem.

Background

▶ Watch: Intro to DNS4EU and threat detection goals (0:00)

The genesis of the DNS4EU project stems from a desire within the European Union to reclaim sovereignty over its digital infrastructure. Historically, a significant portion of DNS traffic from EU citizens was resolved by private companies often located outside the EU, raising concerns about data privacy, regulatory compliance, and potential foreign surveillance. To address these issues, the EU launched DNS4EU, a multi-year project involving a consortium of partners, to create a robust, secure, and privacy-centric DNS resolution infrastructure available for free to all EU citizens. The project explicitly aims to uphold EU regulations, guarantee low latency through a federated architecture, and provide protection for both IPv4 and IPv6 users.

The scale of DNS4EU is staggering, with plans to serve 100 million users and currently processing approximately 1.2 billion DNS queries per day, translating to roughly 1 terabyte of raw data per week. Within this immense undertaking, the Stratosphere Laboratory at the Czech Technical University is responsible for the critical security aspect: identifying new malicious domains. This specific focus distinguishes their work from other groups within the DNS4EU consortium that handle threats like Domain Generation Algorithms (DGAs), phishing, or DDoS attacks.

The core challenge lies in the definition of "new" and "malicious" under such high-volume, privacy-constrained conditions. A "new" malicious domain, in this context, is one that is not yet present in any existing threat intelligence feed, blacklist, or historical report at the moment of detection. The types of "malicious" activities targeted are specifically malware command and control (C2), data delivery, exfiltration, botnets, and spyware infrastructure. Compounding this challenge are severe data limitations: the system only receives raw DNS query data (domain, query type, timestamp, TTL, answer IPs) from Kafka streams. Crucially, client IP addresses are completely anonymized and change every 24 hours, precluding any long-term client behavior analysis or direct geo-location. Furthermore, the system does not have access to URLs or other rich context often available in more traditional web security analyses. This constrained environment necessitates innovative approaches to feature engineering and anomaly detection to accurately identify never-before-seen threats.

Key Findings

▶ Watch: Extracting features and preprocessing for analysis (4:00)

The research presented highlights several critical findings and contributions in the realm of large-scale, privacy-preserving DNS threat detection. Foremost among these is the successful development and deployment of an infrastructure capable of processing 1.2 billion DNS queries daily (approximately 15,000 queries per second), translating to over 1 terabyte of raw data per week. This infrastructure is designed specifically to identify new malicious domains, a much harder problem than detecting known threats, given the vast scale and stringent data anonymization requirements of DNS4EU.

A significant discovery is the efficacy of combining multiple, parallelized machine learning algorithms for anomaly detection. The system leverages Isolation Forest, DBScan, and Gaussian Mixture Models (GMM), running in separate Docker containers, to identify anomalous patterns in DNS traffic. These algorithms are applied to both aggregated domain-level features and client-domain interaction patterns, demonstrating that a multi-faceted algorithmic approach yields superior results in detecting subtle indicators of compromise.

Perhaps the most innovative contribution is the implementation of a Bayesian inference framework for robust false positive reduction and evidence-based scoring. This adaptive system starts with prior beliefs about threat probabilities and continuously updates these beliefs as new evidence (e.g., anomaly detection flags, presence in external threat intelligence feeds, VirusTotal reports) emerges. This probabilistic approach allows for a nuanced assessment of each domain's maliciousness, generating a confidence score that can be used to prioritize blocking actions. Crucially, the system incorporates a unique validation strategy, learning from its mistakes one day behind by checking detected domains against various external sources to refine its detection models.

Finally, the talk showcased the practical success of this system through real-world detections. Despite the challenging constraints, the platform has successfully identified various sophisticated threats, including Predator spyware, Luma stealer, malware command and control servers (e.g., associated with the Blue Delta group), fake software update infrastructure, and DNS tunneling activities. These findings underscore the system's capability to protect DNS4EU users from emerging and previously unknown threats, directly contributing to the project's goals of sovereignty and security.

Technical Deep Dive

▶ Watch: Parallelized ML for identifying new malicious domains (6:00)

The technical architecture underpinning DNS4EU's threat defense system is designed for extreme scale and adaptability, built to handle colossal volumes of data while adhering to strict privacy mandates. The system's journey begins with ingesting raw DNS query data directly from Kafka streams, a high-throughput, distributed streaming platform. This raw data, limited to domain names, query types, timestamps, TTLs, and answer IPs (with client IPs completely anonymized), is then fed into a ClickHouse database. ClickHouse is chosen for its analytical capabilities and ability to manage petabytes of data, crucial for the project's scale.

Within ClickHouse, two primary data views are constructed to facilitate analysis:

1. domains view: Aggregates features per domain, such as the total number of queries, TTL statistics, and the number of unique answer IPs observed over a 24-hour period.
2. client_domain view: Captures statistics on individual client-domain interactions, focusing on the timing and frequency of queries from anonymized clients to specific domains.

Before machine learning algorithms are applied, a critical preprocessing step is undertaken. To manage the immense data volume and focus computational resources on potentially malicious activity, the top 1,000 most frequently queried benign domains (the "tranquil list," e.g., google.com) are filtered out. This step significantly reduces the processing load, allowing the system to concentrate on less common, and thus potentially more suspicious, domains. Further feature engineering is performed, extracting more sophisticated metrics like domain name entropy, aggregate request metrics, and, for client-domain interactions, the Power Spectral Density (PSD) of query timings. PSD analysis helps identify periodic or unusual querying patterns that might indicate automated or botnet activity. Key features extracted include various TTL statistics, request counts, unique answer IPs, IP entropy, sharing count, and the dominant frequency derived from PSD. The limited initial feature set from raw DNS queries necessitates this intensive feature engineering to provide sufficient discriminatory power for the downstream models.

The core of the detection mechanism lies in its machine learning pipeline, which operates in parallel across different Docker containers. The system primarily employs three unsupervised learning algorithms, chosen for their effectiveness in anomaly detection:

• Isolation Forest: This algorithm detects anomalies by isolating data points through random splits in a tree structure. Anomalies, being fewer and different, typically require fewer splits to be isolated, resulting in shorter paths in the decision tree.
• DBScan (Density-Based Spatial Clustering of Applications with Noise): This clustering algorithm groups together closely packed data points, marking as outliers those points that lie alone in low-density regions. It's effective at finding clusters of arbitrary shape and identifying noise.
• Gaussian Mixture Models (GMM): GMMs model the probability distribution of data points as a mixture of several Gaussian distributions. They identify anomalies as points with a low likelihood of belonging to any of the learned Gaussian components.

These algorithms are applied to both the domain-level and client-domain interaction datasets, with their combined outputs feeding into the post-processing stage to generate a consolidated threat intelligence feed.

A crucial component for operationalizing these detections is the Bayesian inference framework for false positive reduction. Given the 1.2 billion daily queries and the overwhelming majority being benign, minimizing false positives is paramount. The Bayesian approach operates as follows:

1. Prior Beliefs: The system starts with human-defined prior beliefs about the probability of a domain being malicious (e.g., 0.01% of all domains are malicious) and the reliability of various threat intelligence sources. These priors include both a percentage and a confidence level.
2. Evidence Collection: For each new domain, the system collects evidence. This includes whether it was flagged as an anomaly by any of the ML models, its presence in external threat intelligence lists, or its status in services like VirusTotal.
3. Posterior Update: Each piece of evidence is used to update the prior beliefs. The system simultaneously models the probability of a domain being malicious and benign. Evidence that aligns with a "malicious story" pushes the belief towards maliciousness, while evidence supporting a "benign story" pushes it the other way. The strength of this push depends on the evidence's inherent probability and the confidence associated with it.
4. Adaptive Learning: The Bayesian framework continuously adapts. After a domain is flagged and potentially blocked, its true nature is verified the following day by checking its appearance in various threat intelligence feeds, tranquil lists, and VirusTotal reports. This "one-day behind" learning loop allows the system to refine its priors and confidence levels for future detections, improving accuracy over time.

The output of this process is a numerical score for each domain, indicating its probability of being malicious. Operators can then set a cutoff score (e.g., block domains with a maliciousness score above 90%) to manage the balance between detection rates and false positive tolerance.

Demo / Proof of Concept

▶ Watch: Validating new detections and scoring maliciousness (17:00)

While the talk did not feature a live demonstration or a proof-of-concept in the traditional sense, the speakers provided compelling evidence of the system's efficacy through real-world case studies and detected malicious domains. These examples illustrate the system's ability to identify sophisticated and previously unknown threats within the vast DNS4EU traffic.

The verification process, which occurs one day after initial detection and potential blocking, assigns a score from 0 to 5 to each domain, reflecting its confirmed maliciousness based on subsequent evidence:

• Score 0: Domains initially flagged but later confirmed as benign (e.g., appearing in the tranquil list, not in any threat intelligence feed, and zero detections on VirusTotal). These represent false positives, which the system aims to minimize (typically around 0.01% of blocked domains).
• Score 1: Domains that are largely benign but might have some minor suspicious attributes. This is often the majority of the blocked list, and allows for flexible cutting points.
• Score 3: Represents "suspicious" domains, often characterized by not being in the tranquil list, appearing in some threat intelligence feeds, but not yet widely reported on platforms like VirusTotal. These are particularly interesting as they often represent emerging threats.
• Score 5: Domains with high confidence of maliciousness, typically appearing in multiple threat intelligence feeds and having significant detections on VirusTotal.

Sebastian Garcia presented several concrete examples of real-world threats detected by the system:

• logstoblog.com: Despite being in the top 100,000 of the tranquil list (suggesting benignity), this domain was identified as an official command and control (C2) server for the Blue Delta group, which targets European individuals in Spanish campaigns. This highlights the system's ability to spot anomalies even within seemingly legitimate domains.
• adop.us: Detected as a digital malware distribution point and a C2 for "brand impression" malware, confirming its role in malicious infrastructure.
• connects.lo.com: Identified as part of a fake software update scheme, a common tactic for distributing malware.
• DNS0.org: Frequently observed being used for DNS tunneling, a technique for exfiltrating data or establishing C2 channels over DNS.
• outres.com: This domain was linked to Predator spyware delivery, indicating the system's capability to detect highly sensitive and dangerous surveillance tools. The presence of client IPs and associated infrastructure provided further insights, although direct client contact is impossible due to anonymization.
• noisy.com and mercha.b: The latter was specifically identified as a C2 for Luma stealer, a prominent information-stealing malware.

These examples demonstrate that the DNS4EU threat detection system is not merely an academic exercise but a highly effective, operational security measure that actively protects EU citizens from a wide array of sophisticated and evolving cyber threats.

Defensive Implications

▶ Watch: Examples of C2, spyware, and malware detections (20:20)

The insights gleaned from the DNS4EU threat detection system offer profound implications for network defenders and security professionals. The scale, privacy constraints, and focus on "new" threats necessitate a re-evaluation of traditional defensive strategies.

1. Embrace Advanced DNS Security at Scale: Organizations, especially those managing large user bases, should prioritize leveraging or implementing advanced DNS resolution services that integrate sophisticated, real-time threat detection. DNS4EU exemplifies how a centralized, privacy-preserving DNS can become a powerful early warning system for emerging threats, significantly enhancing overall network security.

1. Innovate in Feature Engineering: When faced with limited or anonymized data (e.g., no full URLs, anonymized client IPs), defenders must invest heavily in creative feature engineering. The talk demonstrated that even from basic DNS query data (TTL, counts, timings), powerful discriminatory features like domain name entropy and Power Spectral Density can be extracted to uncover subtle malicious patterns.

1. Adopt Multi-Algorithmic Anomaly Detection: Relying on a single detection technique is insufficient against evolving threats. Implementing a pipeline that integrates multiple machine learning algorithms (e.g., Isolation Forest, DBScan, Gaussian Mixture Models) provides a more robust and comprehensive anomaly detection capability, capturing diverse indicators of malicious activity.

1. Implement Adaptive, Probabilistic False Positive Reduction: The Bayesian inference approach for false positive reduction is a critical takeaway. Defenders must move beyond static thresholds and integrate adaptive, evidence-based scoring mechanisms that can learn from past detections and external threat intelligence. This is essential for maintaining operational efficiency and user trust when dealing with billions of daily events where even a low false positive rate can generate an unmanageable volume of alerts.

1. Prioritize "New" Threat Detection: While known threat intelligence feeds are vital, resources must also be allocated to detecting previously unknown or zero-day malicious infrastructure. The DNS4EU system's focus on "new" domains, including sophisticated C2s and spyware not yet in public feeds, highlights the proactive stance required to stay ahead of adversaries.

1. Continuous Monitoring and Adaptation: The system's "one-day behind" learning loop underscores the importance of continuous monitoring, validation, and adaptation of detection models. Security infrastructure should be designed to learn from its mistakes, integrate new evidence, and evolve its understanding of threats over time, ensuring resilience against rapidly changing attack vectors.

1. Choose What to Detect (and What Not To): As emphasized by Garcia, it is impossible to detect everything with a single system. Defenders should strategically define the scope of their detection efforts, specializing in specific threat types (e.g., malware C2 vs. phishing) and leveraging different techniques for each, potentially through coordinated efforts across multiple security teams or services.

Key Takeaways

• Massive Scale, Unique Challenge: Securing DNS4EU, which processes 1.2 billion DNS queries daily for 100 million users, demands an infrastructure capable of handling immense data volumes under strict privacy constraints like anonymized client IPs.
• Focus on "New" Threats: The project specifically targets the detection of previously unknown malicious domains (malware C2, exfiltration, botnets, spyware) that are not yet present in existing threat intelligence feeds, requiring proactive anomaly detection.
• Feature Engineering is Paramount: With limited raw DNS data, extensive feature engineering, including domain name entropy and Power Spectral Density analysis of query timings, is crucial to extract meaningful indicators for machine learning models.
• Multi-Algorithmic Anomaly Detection: A parallelized machine learning pipeline leveraging Isolation Forest, DBScan, and Gaussian Mixture Models effectively identifies diverse anomalous patterns in DNS traffic.
• Adaptive Bayesian False Positive Reduction: A novel Bayesian inference framework uses prior beliefs and continually updates them with evidence (ML outputs, external TI, VirusTotal) to generate a confidence score for maliciousness, significantly reducing false positives and adapting over time.
• Real-World Efficacy: The system has proven its capability by successfully detecting critical threats like Predator spyware C2s, Luma stealer, Blue Delta group malware infrastructure, and DNS tunneling in live DNS4EU traffic, demonstrating its practical value.

About the Speaker(s)

Sebastian Garcia is a researcher at the Stratosphere Laboratory within the Czech Technical University in Prague. His work focuses on cybersecurity, particularly in developing innovative methods for detecting malicious activity in network traffic. For the DNS4EU project, he leads the security research team responsible for identifying new malicious domains at scale.

Tigran Oganesian is also affiliated with the Czech Technical University and contributed to the research presented in the talk. While not physically present at the conference, his expertise and contributions were integral to the development of the DNS4EU threat defense system.