{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,6]],"date-time":"2026-09-06T17:39:08Z","timestamp":1788716348627,"version":"build-2803163510"},"reference-count":63,"publisher":"MDPI AG","issue":"3","license":[{"start":{"date-parts":[[2020,8,12]],"date-time":"2020-08-12T00:00:00Z","timestamp":1597190400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Computers"],"abstract":"<jats:p>The Domain Name System (DNS) was created to resolve the IP addresses of web servers to easily remembered names. When it was initially created, security was not a major concern; nowadays, this lack of inherent security and trust has exposed the global DNS infrastructure to malicious actors. The passive DNS data collection process creates a database containing various DNS data elements, some of which are personal and need to be protected to preserve the privacy of the end users. To this end, we propose the use of distributed ledger technology. We use Hyperledger Fabric to create a permissioned blockchain, which only authorized entities can access. The proposed solution supports queries for storing and retrieving data from the blockchain ledger, allowing the use of the passive DNS database for further analysis, e.g., for the identification of malicious domain names. Additionally, it effectively protects the DNS personal data from unauthorized entities, including the administrators that can act as potential malicious insiders, and allows only the data owners to perform queries over these data. We evaluated our proposed solution by creating a proof-of-concept experimental setup that passively collects DNS data from a network and then uses the distributed ledger technology to store the data in an immutable ledger, thus providing a full historical overview of all the records.<\/jats:p>","DOI":"10.3390\/computers9030064","type":"journal-article","created":{"date-parts":[[2020,8,12]],"date-time":"2020-08-12T09:14:49Z","timestamp":1597223689000},"page":"64","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":20,"title":["Privacy-Preserving Passive DNS"],"prefix":"10.3390","volume":"9","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-5927-6026","authenticated-orcid":false,"given":"Pavlos","family":"Papadopoulos","sequence":"first","affiliation":[{"name":"School of Computing Edinburgh Napier University, Edinburgh EH10 5DT, UK"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3392-9970","authenticated-orcid":false,"given":"Nikolaos","family":"Pitropakis","sequence":"additional","affiliation":[{"name":"School of Computing Edinburgh Napier University, Edinburgh EH10 5DT, UK"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0809-3523","authenticated-orcid":false,"given":"William J.","family":"Buchanan","sequence":"additional","affiliation":[{"name":"School of Computing Edinburgh Napier University, Edinburgh EH10 5DT, UK"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Owen","family":"Lo","sequence":"additional","affiliation":[{"name":"School of Computing Edinburgh Napier University, Edinburgh EH10 5DT, UK"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2966-9683","authenticated-orcid":false,"given":"Sokratis","family":"Katsikas","sequence":"additional","affiliation":[{"name":"Department of Information Security and Communication Technology, Norwegian University of Science and Technology, 2815 Gj\u00f8vik, Norway"},{"name":"Faculty of Pure and Applied Sciences, Open University of Cyprus, 2220 Latsia, Cyprus"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2020,8,12]]},"reference":[{"key":"ref_1","unstructured":"Mockapetris, P.V. (2012, August 11). Domain Names-Concepts and Facilities. RFC 1034. Available online: https:\/\/dl.acm.org\/doi\/book\/10.17487\/RFC1034."},{"key":"ref_2","unstructured":"Antonakakis, M., April, T., Bailey, M., Bernhard, M., Bursztein, E., Cochran, J., Durumeric, Z., Halderman, J.A., Invernizzi, L., and Kallitsis, M. (2017, January 16\u201318). Understanding the mirai botnet. Proceedings of the 26th USENIX Security Symposium (USENIX Security 17), Vancouver, BC, Canada."},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Vissers, T., Joosen, W., and Nikiforakis, N. (2015, January 8\u201311). Parking sensors: Analyzing and detecting parked domains. Proceedings of the 22nd Network and Distributed System Security Symposium (NDSS 2015), San Diego, CA, USA.","DOI":"10.14722\/ndss.2015.23053"},{"key":"ref_4","unstructured":"Stout, B., and McDowell, K. (2012). System and Method for Combating Cybersquatting. (8,285,830), U.S. Patent."},{"key":"ref_5","unstructured":"Weimer, F. (July, January 26). Passive DNS replication. Proceedings of the FIRST Conference on Computer Security Incident, Singapore."},{"key":"ref_6","unstructured":"(2020, August 11). Patrick Breyer v Bundesrepublik Deutschland Case C-582\/14 ECLI:EU:C:2016:779. Available online: https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=CELEX%3A62014CJ0582."},{"key":"ref_7","unstructured":"Spring, J.M., and Huth, C.L. (2012). The impact of passive dns collection on end-user privacy. Secur. Trust. Internet Names, 1\u201311."},{"key":"ref_8","unstructured":"Google (2020, August 11). Google Public DNS. Available online: https:\/\/developers.google.com\/speed\/public-dns\/privacy."},{"key":"ref_9","unstructured":"Cloudflare (2020, August 11). What Is 1.1.1.1?. Available online: https:\/\/developers.cloudflare.com\/1.1.1.1\/what-is-1.1.1.1."},{"key":"ref_10","unstructured":"(2020, August 11). OpenDNS. Available online: https:\/\/www.opendns.com\/about\/global-dns-infrastructure\/."},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Federrath, H., Fuchs, K.P., Herrmann, D., and Piosecny, C. (2011). Privacy-preserving DNS: Analysis of broadcast, range queries and mix-based protection methods. European Symposium on Research in Computer Security, Springer.","DOI":"10.1007\/978-3-642-23822-2_36"},{"key":"ref_12","unstructured":"Khalil, I., Yu, T., and Guan, B. (June, January 30). Discovering malicious domains through passive DNS data graph analysis. Proceedings of the 11th ACM on Asia Conference on Computer and Communications Security, Xi\u2019an, China."},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Gasser, O., Hof, B., Helm, M., Korczynski, M., Holz, R., and Carle, G. (2018, January 26\u201327). In log we trust: Revealing poor security practices with certificate transparency logs and internet measurements. Proceedings of the International Conference on Passive and Active Network Measurement, Berlin, Germany.","DOI":"10.1007\/978-3-319-76481-8_13"},{"key":"ref_14","unstructured":"Farsight Security (2010). DNSDB, Farsight Security."},{"key":"ref_15","unstructured":"VirusTotal (2013). VirusTotal Passive DNS Replication, VirusTotal."},{"key":"ref_16","unstructured":"James, L. (2005). Phishing Exposed, Elsevier."},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Yoon, C., Kim, K., Kim, Y., Shin, S., and Son, S. (2019, January 13\u201317). Doppelg\u00e4ngers on the dark web: A large-scale assessment on phishing hidden web services. Proceedings of the World Wide Web Conference, San Francisco, CA, USA.","DOI":"10.1145\/3308558.3313551"},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Riederer, C., Erramilli, V., Chaintreau, A., Krishnamurthy, B., and Rodriguez, P. (2011, January 14\u201315). For sale: Your data: By: You. Proceedings of the 10th ACM WORKSHOP on Hot Topics in Networks, Cambridge, MA, USA.","DOI":"10.1145\/2070562.2070575"},{"key":"ref_19","unstructured":"Bortzmeyer, S. (2020, August 11). DNS Privacy Considerations. Available online: https:\/\/www.bortzmeyer.org\/7626.html."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"22328","DOI":"10.1109\/ACCESS.2019.2896108","article-title":"A survey on consensus mechanisms and mining strategy management in blockchain networks","volume":"7","author":"Wang","year":"2019","journal-title":"IEEE Access"},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Benisi, N.Z., Aminian, M., and Javadi, B. (2020). Blockchain-based decentralized storage networks: A survey. J. Netw. Comput. Appl., 102656.","DOI":"10.1016\/j.jnca.2020.102656"},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Liu, J., Li, B., Chen, L., Hou, M., Xiang, F., and Wang, P. (2018, January 18\u201321). A data storage method based on blockchain for decentralization DNS. Proceedings of the 2018 IEEE Third International Conference on Data Science in Cyberspace (DSC), Guangzhou, China.","DOI":"10.1109\/DSC.2018.00035"},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"92","DOI":"10.1109\/MCSE.2017.3421554","article-title":"What is the blockchain?","volume":"19","year":"2017","journal-title":"Comput. Sci. Eng."},{"key":"ref_24","unstructured":"Nakamoto, S. (2020, August 11). Bitcoin: A Peer-to-Peer Electronic Cash System. Available online: https:\/\/bitcoin.org\/bitcoin.pdf."},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Zheng, Z., Xie, S., Dai, H., Chen, X., and Wang, H. (2017, January 25\u201330). An overview of blockchain technology: Architecture, consensus, and future trends. Proceedings of the 2017 IEEE International Congress on Big Data (BigData Congress), Honolulu, HI, USA.","DOI":"10.1109\/BigDataCongress.2017.85"},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"8076","DOI":"10.1109\/JIOT.2019.2920987","article-title":"Blockchain for internet of things: A survey","volume":"6","author":"Dai","year":"2019","journal-title":"IEEE Int. Things J."},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"5466","DOI":"10.1109\/JIOT.2020.2978516","article-title":"Blockchain-enabled software-defined industrial internet of things with deep reinforcement learning","volume":"7","author":"Luo","year":"2020","journal-title":"IEEE Int. Things J."},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"5892","DOI":"10.1109\/JIOT.2019.2954380","article-title":"APIS: Privacy-preserving incentive for sensing task allocation in cloud and edge-cooperation mobile internet of things with SDN","volume":"7","author":"Xu","year":"2019","journal-title":"IEEE Int. Things J."},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"8114","DOI":"10.1109\/JIOT.2019.2922538","article-title":"A comprehensive survey of blockchain: From theory to IoT applications and beyond","volume":"6","author":"Wu","year":"2019","journal-title":"IEEE Int. Things J."},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Karandikar, N., Chakravorty, A., and Rong, C. (2019, January 22\u201325). Transactive energy on hyperledger fabric. Proceedings of the 2019 Sixth International Conference on Internet of Things: Systems, Management and Security (IOTSMS), Granada, Spain.","DOI":"10.1109\/IOTSMS48152.2019.8939271"},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Xu, X., Weber, I., Staples, M., Zhu, L., Bosch, J., Bass, L., Pautasso, C., and Rimba, P. (2017, January 3\u20137). A taxonomy of blockchain-based systems for architecture design. Proceedings of the 2017 IEEE International Conference on Software Architecture (ICSA), Gothenburg, Sweden.","DOI":"10.1109\/ICSA.2017.33"},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Androulaki, E., Barger, A., Bortnikov, V., Cachin, C., Christidis, K., De Caro, A., Enyeart, D., Ferris, C., Laventman, G., and Manevich, Y. (2018). Hyperledger fabric: A distributed operating system for permissioned blockchains. Proceedings of the Thirteenth EuroSys Conference, ACM.","DOI":"10.1145\/3190508.3190538"},{"key":"ref_33","unstructured":"Hyperledger Fabric (2020, August 11). Private Data. Available online: https:\/\/hyperledger-fabric.readthedocs.io\/en\/release-2.2\/private-data\/private-data.html."},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Dhillon, V., Metcalf, D., and Hooper, M. (2017). Blockchain Enabled Applications: Understand the Blockchain Ecosystem and How to Make It Work for You, Springer.","DOI":"10.1007\/978-1-4842-3081-7"},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Zhao, W., Yang, S., and Luo, X. (2019, January 14\u201317). On consensus in public blockchains. Proceedings of the 2019 International Conference on Blockchain Technology, Atlanta, GA, USA.","DOI":"10.1145\/3320154.3320162"},{"key":"ref_36","unstructured":"Zdrnja, B. (2006). Security Monitoring of DNS Traffic, University of Auckland."},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Govil, J., and Govil, J. (2007, January 21\u201323). 4G mobile communication systems: Turns, trends and transition. Proceedings of the 2007 International Conference on Convergence Information Technology (ICCIT 2007), Gyeongju, Korea.","DOI":"10.1109\/ICCIT.2007.305"},{"key":"ref_38","unstructured":"Xu, J., Fan, J., Ammar, M.H., and Moon, S.B. (2002, January 12\u201315). Prefix-preserving ip address anonymization: Measurement-based security evaluation and a new cryptography-based scheme. Proceedings of the 10th IEEE International Conference on Network Protocols, Paris, France."},{"key":"ref_39","doi-asserted-by":"crossref","unstructured":"Kountouras, A., Kintis, P., Lever, C., Chen, Y., Nadji, Y., Dagon, D., Antonakakis, M., and Joffe, R. (2016). Enabling network security through active DNS datasets. International Symposium on Research in Attacks, Intrusions, and Defenses, Springer.","DOI":"10.1007\/978-3-319-45719-2_9"},{"key":"ref_40","doi-asserted-by":"crossref","unstructured":"Liang, X., Shetty, S., Tosh, D., Kamhoua, C., Kwiat, K., and Njilla, L. (2017, January 14\u201317). Provchain: A blockchain-based data provenance architecture in cloud environment with enhanced privacy and availability. Proceedings of the 17th IEEE\/ACM International Symposium on Cluster, Cloud and Grid Computing, Madrid, Spain.","DOI":"10.1109\/CCGRID.2017.8"},{"key":"ref_41","unstructured":"Kalodner, H.A., Carlsten, M., Ellenbogen, P., Bonneau, J., and Narayanan, A. (2015). An Empirical Study of Namecoin and Lessons for Decentralized Namespace Design, WEIS."},{"key":"ref_42","unstructured":"Ali, M., Nelson, J., Shea, R., and Freedman, M.J. (2016, January 22\u201324). Blockstack: A global naming and storage system secured by blockchains. Proceedings of the 2016 USENIX Annual Technical Conference (USENIX ATC16), Denver, CO, USA."},{"key":"ref_43","doi-asserted-by":"crossref","first-page":"13640","DOI":"10.1109\/ACCESS.2020.2966428","article-title":"DNSTSM: DNS cache resources trusted sharing model based on consortium blockchain","volume":"8","author":"Yu","year":"2020","journal-title":"IEEE Access"},{"key":"ref_44","unstructured":"Liu, C., and Albitz, P. (2006). DNS and Bind, O\u2019Reilly Media, Inc."},{"key":"ref_45","unstructured":"Vayghan, L.A., Saied, M.A., Toeroe, M., and Khendek, F. (2018, January 2\u20137). Deploying microservice based applications with Kubernetes: experiments and lessons learned. Proceedings of the 2018 IEEE 11th international conference on cloud computing (CLOUD), San Francisco, CA, USA."},{"key":"ref_46","doi-asserted-by":"crossref","unstructured":"Ager, B., M\u00fchlbauer, W., Smaragdakis, G., and Uhlig, S. (2010). Comparing DNS resolvers in the wild. Proceedings of the 10th ACM SIGCOMM Conference on Internet Measurement, ACM.","DOI":"10.1145\/1879141.1879144"},{"key":"ref_47","unstructured":"Fjellskal, E. (2020, August 11). Gamelinux Passive DNS. Available online: https:\/\/github.com\/gamelinux\/passivedns."},{"key":"ref_48","unstructured":"Hyperledger Fabric (2020, August 11). Certificates Github. Available online: https:\/\/github.com\/hyperledger\/fabric-ca."},{"key":"ref_49","doi-asserted-by":"crossref","unstructured":"Thakkar, P., Nathan, S., and Viswanathan, B. (2018, January 25\u201328). Performance benchmarking and optimizing hyperledger fabric blockchain platform. Proceedings of the 2018 IEEE 26th International Symposium on Modeling, Analysis, and Simulation of Computer and Telecommunication Systems (MASCOTS), Milwaukee, WI, USA.","DOI":"10.1109\/MASCOTS.2018.00034"},{"key":"ref_50","unstructured":"Hyperledger Fabric (2020, August 11). Chaincode for Developers. Available online: https:\/\/hyperledger-fabric.readthedocs.io\/en\/release-2.0\/chaincode4ade.html."},{"key":"ref_51","doi-asserted-by":"crossref","unstructured":"Sompolinsky, Y., and Zohar, A. (2015, January 26\u201330). Secure high-rate transaction processing in bitcoin. Proceedings of the International Conference on Financial Cryptography and Data Security, San Juan, Puerto Rico.","DOI":"10.1007\/978-3-662-47854-7_32"},{"key":"ref_52","unstructured":"Bashir, I. (2017). Mastering Blockchain, Packt Publishing Ltd."},{"key":"ref_53","doi-asserted-by":"crossref","unstructured":"Kambourakis, G., Moschos, T., Geneiatakis, D., and Gritzalis, S. (2007, January 3\u20135). Detecting DNS amplification attacks. Proceedings of the International Workshop on Critical Information Infrastructures Security, Malaga, Spain.","DOI":"10.1007\/978-3-540-89173-4_16"},{"key":"ref_54","unstructured":"Ranjan, S. (2012). Detecting DNS Fast-Flux Anomalies. (8,260,914), U.S. Patent."},{"key":"ref_55","unstructured":"Schuba, C. (1993). Addressing Weaknesses in the Domain Name System Protocol. [Master\u2019s Thesis, Purdue University]."},{"key":"ref_56","unstructured":"Piscini, E., Dalton, D., and Kehoe, L. (2017). Blockchain and Cyber Security. Let\u2019s Discuss, Deloitte."},{"key":"ref_57","unstructured":"English, E., Kim, A.D., and Nonaka, M. (2018). Advancing Blockchain Cybersecurity: Technical and Policy Considerations for the Financial Services Industry. Cybersecur. Policy Resil., 81."},{"key":"ref_58","unstructured":"Ali, M., Shea, R., Nelson, J., and Freedman, M.J. (Whitepaper, 2017). Blockstack: A new decentralized internet, Whitepaper."},{"key":"ref_59","unstructured":"Momjian, B. (2001). PostgreSQL: Introduction and Concepts, Addison-Wesley."},{"key":"ref_60","doi-asserted-by":"crossref","first-page":"71","DOI":"10.1145\/2723872.2723882","article-title":"An introduction to Docker for reproducible research","volume":"49","author":"Boettiger","year":"2015","journal-title":"ACM SIGOPS Oper. Syst. Rev."},{"key":"ref_61","unstructured":"Hyperledger Fabric (2020, August 11). Command-Line Interface (CLI). Available online: https:\/\/bmos299-fabric.readthedocs.io\/en\/latest\/API\/CLI.html."},{"key":"ref_62","unstructured":"Antonakakis, M., Perdisci, R., Dagon, D., Lee, W., and Feamster, N. (2010, January 11\u201313). Building a dynamic reputation system for dns. Proceedings of the USENIX Security Symposium, Washington, DC, USA."},{"key":"ref_63","unstructured":"Bilge, L., Kirda, E., Kruegel, C., and Balduzzi, M. (2011). EXPOSURE: Finding Malicious Domains Using Passive DNS Analysis, Ndss."}],"container-title":["Computers"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2073-431X\/9\/3\/64\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T09:59:37Z","timestamp":1760176777000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2073-431X\/9\/3\/64"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,8,12]]},"references-count":63,"journal-issue":{"issue":"3","published-online":{"date-parts":[[2020,9]]}},"alternative-id":["computers9030064"],"URL":"https:\/\/doi.org\/10.3390\/computers9030064","relation":{},"ISSN":["2073-431X"],"issn-type":[{"value":"2073-431X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2020,8,12]]}}}