A multi-layer domain name detection algorithm based on DNS traffic was designed to give a further study to the role of domain in DNS traffic and provide a method for domain’s influence analysis. In the detection stage, DNS traffic was collected from the boundary of the CERNET backbone, then request and response sequences were extracted. Based on the aggregation characteristic of multi-layer domain name and the concurrency of DNS resolution, the sets of parent-child domains in traffic were detected, and a time sliding window mechanism was introduced to measure the results' confidence. In the measurement stage, the detection results were analyzed from multiple perspectives, including the scale and intersection of multi-layer domain name sets, the number of tags of parent-child domain and the resource type of child domain in the set, etc. Then two cases of typical websites with multi-layer domain name were provided. The measurement results verified the existence and characteristics of multi-layer domain name and showed the effectiveness of the algorithm.
Yi-xuan ZHANG,Jian GONG. Multi-layer domain name detection and measurement based on DNS traffic. Journal of ZheJiang University (Engineering Science), 2020, 54(12): 2423-2429.
Tab.1Counts of domain and IP attributed to two units
Fig.3Domain aggregation mapping process
Fig.4Distribution of reliability test
数量
不重复 域名数量
不重复二级 域名数量
请求客户 端数量
请求/应 答总量
DNS请求
4378 064
737 575
113 427
273 744 822
DNS应答
2071 320
465 652
?
414 397 058
Tab.2Statistical analysis of raw data
Fig.5Counts of DNS request and response per day
从域名数量范围
网站数量分布/%
[3, 10]
44.4
[11, 20]
18.0
[21, 30]
9.0
>30
28.6
Tab.3Distribution of websites with different numbers of child domains
被网站引用数量
从域名数量分布/%
[1, 10]
65.6
[11, 20]
24.0
[21, 30]
5.0
>30
5.4
Tab.4Distribution of child domains referenced by different numbers of websites
Fig.6Ratio of number of tags of parent-child domain (CDF)
Fig.7Ratio of number of domain with the same second level domain (CDF)
二级域名
运营商
二级域名
运营商
akamai.net
Akamai
cdn20.com
网宿科技
wsglb0.com
wsglb0.com
aliyuncs.com
阿里云
qq.com
腾讯云
alibabadns.com
alikunlun.com
Tab.5Top second level domain and operator
主域名
网站类型
资源从域名
资源类型
www.cctv.com
新闻 门户
p1.img.cctvpic.com
JS，图片，CSS
js.player.cntv.cn
JS
time.tv.cctv.com
PHP
api.cntv.cn
接口
p.data.cctv.com
JS，gif
www.iqiyi.com
视频 网站
stc.iqiyipic.com
JS,图片，CSS
static.iqiyi.com
JS,字体
hm.baidu.com
JS，gif
Tab.6Typical websites with multi-layer domain name
[1]
CLABURN T. Google officially speeds up Web page loads [EB/OL]. (2012-10-11) [2019-09-29]. https://www.informationweek.com/web/google-officially-speeds-up-web-page-loads/d/d-id/1106818.
[2]
KING A B. Speed up your site: Web site optimization [M]. [S. l. ]: New Riders Pub, 2004: 46-48.
[3]
PATRICK N. Speed up slow Web pages with this simple trick [EB/OL]. (2017-04-03) [2019-09-29]. https://www.networkworld.com/article/3186976/speed-up-slow-web-pages-with-this-simple-trick.html.
[4]
秦臻. 基于内容发布网络(CDN)的域名解析系统[D]. 成都: 电子科技大学, 2012: 19-31. QIN Zhen. Domain name resolution system based on content publishing network (CDN) [D]. Chengdu: University of Electronic science and technology of China, 2012: 19-31.
[5]
FU Cui-yu. Exploration of Web front-end development technology and optimization direction [C]// Proceedings of 2016 2nd International Conference on Electronics, Network and Computer Engineering. Paris: Atlantis Press, 2016: 168-171.
[6]
SAWANT O, GODSE S Web-Page complexity and optimization mechanism to reduce Web-Page load time[J]. International Journal of Computing and Technology, 2014, 1 (9): 444- 447
[7]
NETRAVALI R A. Understanding and improving Web page load times on modern networks [D]. Boston: MIT, 2014.
[8]
MUNYARADZI Z, MAXMILLAN G, AMANDA M N Effects of Web page contents on load time over the Internet[J]. Journal of Science and Research, 2013, 2 (9): 75- 79
[9]
郎君. 基于Chrome的网页加载延迟优化方法研究与实现[D]. 大连: 大连理工大学, 2017: 5-11. LANG Jun. Research and implementation of Web page loading delay optimization technology based on Chrome [D]. Dalian: Dalian University of Technology, 2017: 5-11.
[10]
仲晓. 网页加载过程的监控与统计分析[D]. 北京: 北京邮电大学, 2013: 4-14. ZHONG Xiao. Monitoring and statistical analysis of website loading process [D]. Beijing: Beijing University of Posts and Telecommunications, 2013: 4-14.
[11]
POMETTO A, CRUZ S. Mozilla embarks on noble mission to speed up the Web by bringing JPEG into the 21st century [EB/OL]. (2014-03-06) [2019-09-29]. https://www.extremetech.com/computing/178005-mozilla-embarks-on-noble-mission-to-speed-up-the-web-by-bringing-jpeg-into-the-21st-century.
[12]
TUOVINEN J, UOTILA T. Evaluation of page load performance of Web browser: 201213668391 [P]. 2015-03-17.
[13]
BELSHE M, PEON R. Reduction of Web page load time using HTTP header compression: 201113183048 [P]. 2015-12-01.
[14]
彭成维, 云晓春, 张永铮, 等 一种基于域名请求伴随关系的恶意域名检测方法[J]. 计算机研究与发展, 2019, 56 (6): 1263- 1274 PENG Cheng-wei, YUN Xiao-chun, ZHANG Yong-zheng, et al Detecting malicious domains using co-occurrence relation between DNS query[J]. Computer Research and Development, 2019, 56 (6): 1263- 1274
doi: 10.7544/issn1000-1239.2019.20180481
IKRAM M, MASOOD R, TYSON G, et al. The chain of implicit trust: an analysis of the Web third-party resources loading [EB/OL]. (2019-02-19) [2019-09-29]. http://arxiv.org/abs/1901.07699.
[17]
GAO H Y, YEGNESWARAN V, CHEN Y, et al An empirical reexamination of global DNS behavior[J]. ACM SIGCOMM Computer Communication Review, 2013, 43 (4): 267- 278
[18]
JAJODIA S, ZHOU J Y. Security and privacy in communication networks [M]. Berlin: Springer, 2010: 446-459.
[19]
LIU B J, LIU Z, ZONG P Y, et al. TraffickStop: detecting and measuring illicit traffic monetization through large-scale DNS analysis [C]// 2019 IEEE European Symposium on Security and Privacy. Piscataway: IEEE, 2019: 560-575.
