Peeking Through the Cloud: DNS-Based Estimation and Its Applications

Abstract

Abstract. Reliable network demographics are quickly becoming a much sought-after digital commodity. However, as the need for more refined Internet demographics has grown, so too has the tension between privacy and utility. Unfortunately, current techniques lean too much in favor of functional requirements over protecting the privacy of users. For example, the most prominent proposals for measuring the relative popularity of a website depend on the deployment of client-side measurement agents that are generally perceived as infringing on users' privacy, thereby limiting their wide scale adoption. Moreover, the client-side nature of these techniques also makes them susceptible to various manipulation tactics that undermine the integrity of their results. In this paper, we propose a new estimation technique that uses DNS cache probing to infer the density of clients accessing a given service. Compared to earlier techniques, our scheme is less invasive as it does not reveal user-specific traits, and is more robust against manipulation. We demonstrate the flexibility of our approach through two important security applications. First, we illustrate how our scheme can be used as a lightweight technique for measuring and verifying the relative popularity rank of different websites. Second, using data from several hundred botnets, we apply our technique to indirectly measure the infected population of this increasing Internet phenomenon.

Accurate DNS query characteristics estimation via active probing

“…random variables. The assumption indicates that an IAT in the sequence is independent of its preceding IATs and was commonly used in previous works (Akcan et al, 2008;Rajab et al, 2008;Jung et al, 2003Jung et al, , 2002. The i.i.d.…”

“…Existing methods (Akcan et al, 2008;Rajab et al, 2008) assume that the DNS query IATs are exponentially distributed for any given domain. Therefore, the observed CRIs have exactly the same distribution model with the DNS query IATs as FðxÞ ¼ G t ðxÞ.…”

“…As a result, the model has to be (i) sufficiently flexible to cope with the high diversity of DNS query patterns and meanwhile (ii) generic enough to simplify the design of the estimation algorithm. Existing methods (Akcan et al, 2008;Rajab et al, 2008) make the assumption that DNS query IATs for any domain follow the exponential distribution and therefore fail to profile DNS query patterns with high diversity. In fact, our empirical study based on large-scale datasets collected from realworld networks has demonstrated that the exponential distribution can only fits a small proportion of around 35% domains.…”

“…In practice (Akcan et al, 2008;Rajab et al, 2008), the query behavior of a domain is usually represented by its DNS query interarrival times (IATs) while its cache behavior is characterized by cache refresh intervals (CRIs), a sequence of time intervals between the removal and the immediately successive creation of its cache entry. Therefore, the specific design target is twofold:…”

On measuring the client-side DNS infrastructure

“…Several studies [10,18,23] show that information gleaned from DNS resolvers may be used to measure various aspects of the Internet such as popularity of Web sites and inter-host delays. Our work supports these efforts by developing effective discovery strategies and showing the diversity of behavior in differing implementations.…”