  Improperly configured domain name system (DNS) servers are sometimes used as
packet reflectors as part of a DoS or DDoS attack. Detecting packets created as
a result of this activity is logically possible by monitoring the DNS request
and response traffic. Any response that does not have a corresponding request
can be considered a reflected message; checking and tracking every DNS packet,
however, is a non-trivial operation. In this paper, we propose a detection
mechanism for DNS servers used as reflectors by using a DNS server feature
matrix built from a small number of packets and a machine learning algorithm.
The F1 score of bad DNS server detection was more than 0.9 when the test and
training data are generated within the same day, and more than 0.7 for the data
not used for the training and testing phase of the same day.

Networking and Internet Architecture;Machine Learning