Visualizing and characterizing DNS lookup behaviors via log-mining

Lai, Qingnan; Zhou, Changling; Ma, Hao; Wu, Zhen; Shi-Yang, Chen

doi:10.1016/j.neucom.2014.09.099

Cited by 10 publications

(7 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…There exist numerous pieces of research on the analysis of DNS request logs. A part of the research [3][4][5][6][7] focused on the logs' information itself, analyzing user behavior in terms of domain names and resolution records (Section 2.1). In addition, there has been another research direction [8][9][10][11] that has concentrated on a specific group of university users and analyzed user actions of such groups based on DNS logs and network measurements (Section 2.2).…”

Section: Related Workmentioning

confidence: 99%

“…Their analysis used network traffic data from 159 end users over 10 days. Lai et al [7] analyzed query logs from three major DNS servers in a large university network in China to understand the overall trends in network usage. Robberechts et al [4] analyzed DNS query logs from a Belgian ccTLD registry and designed a system architecture for detecting security threats in the logs and storing the logs.…”

Section: Dns Logmentioning

confidence: 99%

“…Although DNS request log-based analyses have been extensively performed [3][4][5][6][7], works from the perspective of large groups of university users are still lacking. Some researchers [8][9][10][11] accomplished great work on using IPv6 by CERNET users, but there were some limitations on the dataset they used.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

DNS Request Log Analysis of Universities in Shanghai: A CDN Service Provider’s Perspective

et al. 2022

View full text Add to dashboard Cite

Understanding the network usage patterns of university users is very important today. This paper focuses on the research of DNS request behaviors of university users in Shanghai, China. Based on the DNS logs of a large number of university users recorded by CERNET, we conduct a general analysis of the behavior of network browsing from two perspectives: the characteristics of university users’ behavior and the market share of CDN service providers. We also undertake experiments on DNS requests patterns for CDN service providers using different prediction models. Firstly, in order to understand the university users’ Internet access patterns, we select the top seven universities with the most DNS requests and reveal the characteristics of different university users. Subsequently, to obtain the market share of different CDN service providers, we analyze the overall situation of the traffic distribution among different CDN service providers and its dynamic evolution trend. We find that Tencent Cloud and Alibaba Cloud are leading in both IPv4 and IPv6 traffic. Baidu Cloud has close to 15% in IPv4 traffic, but almost no fraction in IPv6 traffic. Finally, for the characteristics of different CDN service providers, we adopt statistical models, traditional machine learning models, and deep learning models to construct tools that can accurately predict the change in request volume of DNS requests. The conclusions obtained in this paper are beneficial for Internet service providers, CDN service providers, and users.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Dns Logmentioning

confidence: 99%

See 1 more Smart Citation

DNS Request Log Analysis of Universities in Shanghai: A CDN Service Provider’s Perspective

et al. 2022

View full text Add to dashboard Cite

show abstract

“…Kumar et al [27] discuss the mis-issuance of security certificate using Zlint, and found only 0.02% of certificate are mis-issued. Lai et al [28] present an algorithm to visualise top DNS server queries. Krohnke et al [26] discuss the impact of location of DNS server on DNS query responses if, for example, it is within only one AS or domain.…”

Section: Related Workmentioning

confidence: 99%

Network service dependencies in commodity internet-of-things devices

Yadav

Mortier

et al. 2019

Proceedings of the International Conference on Internet of Things Design and Implementation

View full text Add to dashboard Cite

We continue to see increasingly widespread deployment of IoT devices, with apparent intent to embed them in our built environment likely to accelerate if smart city and related programmes succeed. In this paper we are concerned with the ways in which current generation IoT devices are being designed in terms of their ill-considered dependencies on network connectivity and services. Our hope is to provide evidence that such dependencies need to be better thought through in design, and better documented in implementation so that those responsible for deploying these devices can be properly informed as to the impact of device deployment (at scale) on infrastructure resilience. We believe this will be particularly relevant as we feel that commodity IoT devices are likely to be commonly used to retrofit "smart" capabilities to existing buildings, particularly domestic buildings.To the existing body of work on network-level behaviour of IoT devices, we add (i) a protocol-level breakdown and analysis of periodicity, (ii) an exploration of the service and infrastructure dependencies that will implicitly be taken in "smart" environments when IoT devices are deployed, and (iii) examination of the robustness of device operation when connectivity is disrupted. We find that many devices make use of services distributed across the planet and thus appear dependent on the global network infrastructure even when carrying out purely local actions. Some devices cease to operate properly without network connectivity (even where their behaviour appears, on the face of it, to require only local information, e.g., the Hive thermostat). Further, they exhibit quite different network behaviours, typically involving significantly more traffic and possibly use of otherwise unobserved protocols, when connectivity is recovered after some disruption. CCS CONCEPTS• Networks → Network measurement.

show abstract

“…The paper by Lai et al [11] tried to explore the behaviors of DNS lookup by mining DNS logs from three primary DNS servers in a large university campus network in China. The used dataset is made up of two parts, namely DNS query logs and messages received or sent by DNS servers.…”

mentioning

confidence: 99%