Inferring popularity of domain names with DNS traffic: exploiting cache timeout heuristics

Akihiro Shimoda, Keisuke Ishibashi, Kazumichi Sato, Masayuki Tsujino, Takeru Inoue, Masaki Shimura, Takanori Takebe, Kazuki Takahashi, Tatsuya Mori, Shigeki Goto

Research output: Chapter in Book/Report/Conference proceedingConference contribution

1 Citation (Scopus)

Abstract

Popularity ranking of Internet services is an important metric for network operators, because it enables mid- to-long term planning of their network facilities and root cause analysis for unexpected traffic. The service-oriented traffic monitoring is much helpful to infer the popularity, hence it has been gathering much attention from both researchers and practitioners. Lately, service identification of a given flow has become very difficult due to the rapid growth of CDNs and/or encrypted traffic, while some research works employed preceding DNS traffic as a hint. However, because of its cache mechanism, the DNS message count deviates from the actual number of flows, which can greatly degrade the ranking reliability. We propose a theoretical model for inferring the user's number of accesses per domain name by exploiting the characteristics of the DNS message count. To the best of our knowledge, this paper is the first attempt to formulate the effect of user's stub resolvers; previous studies were focused on analyzing the effect of cache servers. We evaluated the precision of our model with a real dataset of traffic of thousands of users. By analyzing the top-50 domain names by the number of users, we can infer the number of flows within a 24% error rate on average in 42 out of 50 FQDNs.

Original languageEnglish
Title of host publication2015 IEEE Global Communications Conference, GLOBECOM 2015
PublisherInstitute of Electrical and Electronics Engineers Inc.
ISBN (Electronic)9781479959525
DOIs
Publication statusPublished - 2015
Event58th IEEE Global Communications Conference, GLOBECOM 2015 - San Diego, United States
Duration: 2015 Dec 62015 Dec 10

Publication series

Name2015 IEEE Global Communications Conference, GLOBECOM 2015

Other

Other58th IEEE Global Communications Conference, GLOBECOM 2015
CountryUnited States
CitySan Diego
Period15/12/615/12/10

ASJC Scopus subject areas

  • Computer Networks and Communications
  • Electrical and Electronic Engineering
  • Communication

Fingerprint Dive into the research topics of 'Inferring popularity of domain names with DNS traffic: exploiting cache timeout heuristics'. Together they form a unique fingerprint.

Cite this