Lightweight Anomaly-Based Detection Using Cuckoo Search Algorithm and Decision Tree to Mitigate Man-in-the-Middle Attacks in DNS

As technology advances, the services provided by domain servers require new innovative techniques that can be optimized for frequent changes. Man-in-the-Middle (MitM) attacks on Domain Name Servers (DNS) pose a security threat, enabling attackers to intercept, modify, and redirect network traffic to malicious sites or users. This study designed an anomaly-based detection scheme that identifies and mitigates MitM attacks on DNS. The proposed model utilizes machine learning algorithms and statistical analysis techniques to ensure that the analysis of DNS query patterns can efficiently detect anomalies associated with the MitM. By integrating the Cuckoo Search Algorithm, the scheme minimizes false positives while improving the detection rate. The Proposed scheme was evaluated using the Internet of Things Intrusion Detection (IoTID) and Intrusion Detection System (IDS) datasets, achieving a detection accuracy of 99.6% and demonstrating its effectiveness in minimizing the MitM attacks on DNS.