Querent-centric Domain Name System Modeling and Its Application in Passive Software Discovery
Jian Qu, Xiaobo Ma, Wenmao Liu · 2021 8th International Conference on Dependable Systems and Their Applications (DSA) · 2021
Domain Name System (DNS) is indispensable to the daily operation of all Internet services, computer programs, smartphones, etc. It has been commonly explored as a vantage point for network monitoring. However, a fundamental question that whether a DNS query originating from a querent is issued by humans or software entities remains not deeply investigated. Tackling such a question enables us to further passively discover software entities that the querent uses from DNS traffic. In this paper, we systematically perform querent-centric DNS modeling and explore its application in passive software discovery. Through in-depth measurement of real-world DNS traffic involving 4,398 querents, we develop an entropy-based method to distinguish between human and non-human domain names, and propose a community-based software discovery solution. The measurement and experiments show that our methods can well characterize the non-human and human DNS query behavior, and achieve passive software discovery.