Towards a Model of DNS Client Behavior

Schomp, Kyle; Rabinovich, Michael; Allman, Mark

doi:10.1007/978-3-319-30505-9_20

Cited by 16 publications

(9 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…On 75 % of the days, more than 2,053 users are active. All in all, our dataset exhibits characteristics that are in line with the results of Schomp et al who provide a more extensive analysis of DNS client behavior [52].…”

Section: Preprocessingsupporting

confidence: 87%

Tracked Without a Trace

Kirchler

Herrmann

Lindemann

et al. 2016

Proceedings of the 2016 ACM Workshop on Artificial Intelligence and Security

View full text Add to dashboard Cite

Behavior-based tracking is an unobtrusive technique that allows observers to monitor user activities on the Internet over long periods of time-in spite of changing IP addresses. Previous work has employed supervised classifiers in order to link the sessions of individual users. However, classifiers need labeled training sessions, which are difficult to obtain for observers. In this paper we show how this limitation can be overcome with an unsupervised learning technique. We present a modified k-means algorithm and evaluate it on a realistic dataset that contains the Domain Name System (DNS) queries of 3,862 users. For this purpose, we simulate an observer that tries to track all users, and an Internet Service Provider that assigns a different IP address to every user on every day. The highest tracking accuracy is achieved within the subgroup of highly active users. Almost all sessions of 73 % of the users in this subgroup can be linked over a period of 56 days. 19 % of the highly active users can be traced completely, i. e., all their sessions are assigned to a single cluster. This fraction increases to 40 % for shorter periods of seven days. As service providers may engage in behavior-based tracking to complement their existing profiling efforts, it constitutes a severe privacy threat for users of online services. Users can defend against behavior-based tracking by changing their IP address frequently, but this is cumbersome at the moment.

show abstract

Section: Preprocessingsupporting

confidence: 87%

Tracked Without a Trace

Kirchler

Herrmann

Lindemann

et al. 2016

Proceedings of the 2016 ACM Workshop on Artificial Intelligence and Security

View full text Add to dashboard Cite

show abstract

“…However, the clustering purpose is unique in our work. We use DNS clustering to find the correlated DNS queries of encrypted network flows, and the main challenge is how to overcome the background traffic, as illustrated in the section “Mobile app traffic observations.” Therefore, the typical clustering methods, such as the X-means 31 and the DBSCAN algorithm 32 used in previous work, 29,30 are improper for our purpose (we have tested the X-means and the DBSCAN algorithm in our experiments, and the clustering accuracies are both less than 40%).…”

Section: Methodsmentioning

confidence: 99%

“…The clustering of DNS traffic has been studied in recent work 29,30 to detect malicious domains and model client Figure 6. The main procedure of the proposed method for identifying apps for encrypted mobile network traffic.…”

Section: Dns Clusteringmentioning

confidence: 99%

Mobile app identification for encrypted network flows by traffic correlation

Zhang

et al. 2018

International Journal of Distributed Sensor Networks

View full text Add to dashboard Cite

Mobile application (simply ''app'') identification at a per-flow granularity is vital for traffic engineering, network management, and security practices. However, uncertainty is caused by a growing fraction of encrypted traffic such as Hypertext Transfer Protocol Secure. To address this challenge, we have carefully analyzed mobile app traffic (mainly including Domain Name System, Hypertext Transfer Protocol, and encrypted traffic such as Secure Sockets Layer and Transport Layer Security) and observed that (1) the sets of server hostnames queried by different apps are distinguishable; (2) mobile apps may query multiple server hostnames simultaneously, that is, apps may send several Domain Name System lookups within a short time interval; and (3) the encrypted traffic may be similar to various other network flows generated by the same app. Based on these three observations, in this article, we propose a novel app identification methodology for encrypted network flows. To be specific, temporal, lexical, and metadata similarity are investigated to select correlated traffic and information retrieving techniques are adopted to identify apps. We ran a thorough set of experiments to assess the performance of the proposed approaches. The experimental results show that the identification accuracy can be as high as 95%, and the proposed methods have low storage requirements as well as fast training speeds.

show abstract

“…Callahan et al passively monitored DNS and related traffic within a residential network to understand the impact of DNS server and client behaviors [8]. Schomp et al characterized DNS clients with the aim of developing an analytic model of client interaction within the larger DNS ecosystem [9]. Chen et al analyzed disposable domains that are likely generated automatically.…”

Section: Related Workmentioning

confidence: 99%

Cache Effect of Shared DNS Resolver

Fujiwara¹,

Sato

Yoshida

2019

IEICE Trans. Commun.

View full text Add to dashboard Cite

Recent discussions on increasing the efficiency of the Internet's infrastructure have centered on removing the shared Domain Name System (DNS) resolver and using a local resolver instead. In terms of the cache mechanism, this would involve removing the shared cache from the Internet. Although the removal of unnecessary parts tends to simplify the overall system, such a large configuration change would need to be analyzed before their actual removal. This paper presents our analysis on the effect of a shared DNS resolver based on campus network traffic. We found that (1) this removal can be expected to amplify the DNS traffic to the Internet by about 3.9 times, (2) the amplification ratio of the root DNS is much higher (about 6.3 times), and (3) removing all caching systems from the Internet is likely to amplify the DNS traffic by approximately 16.0 times. Thus, the removal of the shared DNS resolver is not a good idea. Our data analysis also revealed that (4) many clients without local caches generate queries repeatedly at short intervals and (5) deploying local caches is an attractive technique for easing DNS overhead because the amount of traffic from such clients is not small.

show abstract

Towards a Model of DNS Client Behavior

Cited by 16 publications

References 6 publications

Tracked Without a Trace

Tracked Without a Trace

Mobile app identification for encrypted network flows by traffic correlation

Cache Effect of Shared DNS Resolver

Contact Info

Product

Resources

About