Inferring Popularity of Domain Names with DNS Traffic: Exploiting Cache Timeout Heuristics

摘要: Popularity ranking of Internet services is an important metric for network operators, because it enables mid- to-long term planning their facilities and root cause analysis unexpected traffic. The service-oriented traffic monitoring much helpful to infer the popularity, hence has been gathering attention from both researchers practitioners. Lately, service identification a given flow become very difficult due rapid growth CDNs and/or encrypted traffic, while some research works employed preceding DNS as hint. However, its cache mechanism, message count deviates actual number flows, which can greatly degrade reliability. We propose theoretical model inferring user's accesses per domain name by exploiting characteristics count. To best our knowledge, this paper first attempt formulate effect stub resolvers; previous studies were focused on analyzing servers. evaluated precision with real dataset thousands users. By top-50 names users, we flows within 24% error rate average in 42 out 50 FQDNs.