Application of a precedent analysis paradigm for the purposes of multibase cloud monitoring of DNS traffic

Abstract

Relevance. The increasing complexity of DNS infrastructure and the growing level of threats in the network environment necessitate the development of intelligent DNS traffic monitoring tools capable of providing transparent, adaptive, and well-grounded detection of behavioral anomalies. Particular relevance is associated with the implementation of approaches that enhance the traceability of decision-making logic in artificial intelligence (AI) systems.

Purpose. The purpose of this study is to experimentally investigate a prototype software tool for monitoring the current state of DNS traffic with extensive implementation of AI capabilities, the logic of which is based on the concept of case-based reasoning (CBR) for behavioral DNS traffic anomaly analysis.

Research Methods. The study employs simulation modeling methods, multi-base measurements of DNS query processing time using a system of distributed cloud-based sensor-testers, as well as case-based reasoning algorithms for intelligent post-processing of data. The prototype was implemented as a Python client integrated with the Gemini API, operating on a dataset formed based on the results of previous studies [1–2]. During operation, the system autonomously modifies the anomaly registry by adding new cases based on analytical processing results.

Results. The obtained results demonstrate that the proposed DNS traffic monitoring approach ensures the detection of both previously known anomalies and the localization of previously unidentified irregularities. The feasibility of applying the case-based approach to improve the efficiency of adjusting the parameters of the active Response Policy Zone (RPZ) [3] and to enhance situational awareness of personnel regarding DNS traffic security has been confirmed. At the same time, the experiments revealed a so-called “clustering” effect that may lead to false positive event assessments and, consequently, contradictory interpretations of the observed network events.

Conclusions. The revision of existing constraints and analytical tasks for AI modules, followed by further modeling, confirmed that the introduced modifications significantly reduced the identified “clustering” effect and improved the reliability of anomaly interpretation based on a defined system of indirect (implicit) indicators. The obtained results confirm the feasibility of further developing the case-based reasoning approach in intelligent DNS traffic monitoring systems.