CDN-hosted Domain Detection with Supervised Machine Learning through DNS Records
Hailing Li, Longtao He, Hui Zhang, Kai Zhang, Xiaoqian Li, Chenghai He · 2020
Content delivery network (CDN) has become a critical infrastructure in the Internet and DNS-based request routing mechanism is widely used in CDNs. The current methods of CDN detection mainly use information such as hostname keywords, keywords in HTTP error message, PTR records and the public posted IP ranges. However, the application scope of these methods is limited. Considering the fact that CDN-hosted sites show some characteristics during the domain name resolution process, a novel machine learning algorithm for CDN-hosted site detection is proposed in this paper and three categories of features related to IPs, domains and TTLs are extracted from the DNS records. Machine learning classifiers are trained on a labeled dataset and the experimental results show that the method can achieve good precision and F1 score. Based on the feature evaluation, the IP and TTL related features are found to be more useful.