Privacy-Conscious Threat Intelligence Using DNSBloom

Roland van Rijswijk - Deij, Gijs Rijnders, Matthijs Bomhoff, Luca Allodi

    Research output: Chapter in Book/Report/Conference proceedingConference contributionAcademicpeer-review

    6 Citations (Scopus)
    2 Downloads (Pure)


    The Domain Name System (DNS) is an essential component of every interaction on the Internet. DNS translates human-readable names into machine readable IP addresses. Conversely, DNS requests provide a wealth of information about what goes on in the network. Malicious activity – such as phishing, malware and botnets – also makes use of the DNS. Thus, monitoring DNS traffic is essential for the security team’s toolbox. Yet because DNS is so essential to Internet services, tracking DNS is also highly privacy-invasive, as what domain names a user requests reveals their Internet use. Therefore, in an age of comprehensive privacy legislation, such as Europe’s GDPR, simply logging every DNS request is not acceptable.
    In this paper we present DNSBLOOM, a system that uses Bloom Filters as a privacy-enhancing technology to store DNS requests. Bloom Filters act as a probabilistic set, where a membership test either returns probable membership (with a small false positive probability), or certain non-membership. Because Bloom Filters do not store original information, and because DNSBLOOM aggregates queries from multiple users over fixed time periods, the system offers strong privacy guarantees while enabling security professionals to check with a high degree of confidence whether certain DNS queries associated with malicious activity have occurred. We validate DNSBLOOM through three case studies performed on the production DNS infrastructure of a major global research network, and release a working prototype, that integrates with popular DNS resolvers, in open source.
    Original languageEnglish
    Title of host publication2019 IFIP/IEEE Symposium on Integrated Network and Service Management, IM 2019
    Place of PublicationPiscataway, NJ
    Number of pages9
    ISBN (Electronic)978-3-903176-15-7
    ISBN (Print)978-1-7281-0618-2
    Publication statusPublished - 16 May 2019
    Event16th IFIP/IEEE International Symposium on Integrated Network Management - DoubleTree by Hilton Hotel Washington DC - Crystal City, Washington DC, United States
    Duration: 8 Apr 201912 Apr 2019
    Conference number: 16


    Conference16th IFIP/IEEE International Symposium on Integrated Network Management
    Abbreviated titleIM 2019
    Country/TerritoryUnited States
    CityWashington DC
    Internet address


    • DNS
    • GDPR
    • Indicator-of-compromise
    • Measurement
    • Privacy
    • Threat detection


    Dive into the research topics of 'Privacy-Conscious Threat Intelligence Using DNSBloom'. Together they form a unique fingerprint.

    Cite this