Determining OS and Applications by DNS Traffic Analysis
Igor Voronov, Kirill Gnezdilov · 2021
DNS-protocol is a protocol that allows you to get IP-address of websites to establish connection between a server and a client device. Today this protocol is still used unencrypted while having an add-on for data transmission security. In this paper we show that by analyzing DNS traffic we can obtain not only a list of websites visited by users but some additional information. We also introduce our DNS-based system that can obtain the following information about client devices from DNS traffic: OS, applications and web services. Our system uses classification algorithms based on parsing DNS queries and match them to the list of regular expressions.