Encoder-FFN Model with Honeypot Deception for DNS Cache Poisoning Detection and Mitigation in Software-Defined Network

The increasing complexity and volume of cyberattacks present a significant challenge to traditional intrusion detection and prevention systems. One prevalent attack is domain name server (DNS) cache poisoning, which involves injecting falsified information into DNS server caches to redirect legitimate traffic to malicious websites, thereby compromising user security and confidentiality. This paper introduces a novel approach to detecting and mitigating DNS cache poisoning attacks in software-defined network (SDN) by combining machine learning (ML) techniques and cyber deception strategies. The proposed ML model is specifically engineered to process the mixed numerical and textual nature of DNS data and achieve a high detection rate on well-known datasets. Furthermore, the strategic implementation of cyber deception techniques, such as the use of honeypots and fictitious users, resulted in a 94.8% reduction in successful DNS spoofing incidents within the tested SDN environments. Unlike prior ML-only DNS cache poisoning detectors, which typically analyse handcrafted numeric features and achieve detection rates below 90%, our hybrid model fuses both textual context and numerical statistics, giving a further improvement in accuracy in benchmark datasets. The SDN controller plays a pivotal role in coordinating these mitigation actions based on real-time information from the DNS filter, enabling a swift and adaptive response to detected attacks. This integrated framework significantly enhances the security and resilience of SDNs against sophisticated DNS attacks.