Encrypted DNS analysis strategy attribution method and system based on multi-dimensional feature analysis

Abstract

The invention discloses an encrypted DNS analysis strategy attribution method and system based on multi-dimensional feature analysis, and belongs to the technical field of computer networks. The method comprises the following steps: constructing a strategy behavior feature library of a network entity, wherein the strategy behavior feature library is composed of abnormal response strategy features for the network entity; collecting analysis strategy behaviors of the target DNS analyzer on various domain names and response data generated by the analysis strategy behaviors; extracting a target multi-dimensional feature vector from the response data; the target multi-dimensional feature vector is compared with a policy behavior feature library to cause the analytic policy behavior to one or more network entities. According to the invention, accurate attribution of strategy behaviors can be realized in an encryption environment.

Description

Technical Field

[0001] This invention belongs to the field of computer network technology, specifically relating to an attribution method and system for encrypted DNS resolution strategies based on multidimensional feature analysis. Background Technology

[0002] With increasing emphasis on user privacy and security on the internet, encrypted DNS technologies (such as DNS-over-HTTPS, DNS-over-TLS, and DNS-over-QUIC) have been widely adopted. However, while encrypted DNS protects the "last mile" of communication, its complete resolution chain can still be subject to interference from multiple parties, leading to discrepancies between the DNS responses received by users and their expectations—a phenomenon known as "response inconsistency." The sources of these abnormal service responses are diverse and often covert, potentially stemming from proactive filtering by the resolver itself, strategic redirection by upstream services, or hijacking by network middleware. Due to the variety of sources and strategies involved, and the lack of transparency in the resolution process, this inconsistency poses a serious challenge to network security, making fault location, attribution of responsibility, and risk assessment extremely difficult, severely undermining the security and reliability that encrypted DNS should provide.

[0003] Currently, research on DNS response inconsistencies largely focuses on "phenomenon detection," i.e., identifying inconsistencies by comparing them with trusted control groups. However, it generally lacks the ability to accurately trace and attribute the source of inconsistencies. When faced with complex and opaque resolution chains like encrypted DNS, traditional methods often have coarse-grained diagnostics and cannot accurately pinpoint the responsible party. Therefore, the industry urgently needs an analytical mechanism that can penetrate the opacity of encrypted DNS and has fine-grained attribution capabilities to solve the technical problem of the opacity of encrypted DNS resolution chains, which makes it difficult to determine the responsible party for abnormal service responses. Summary of the Invention

[0004] This invention proposes a method and system for attributing encrypted DNS resolution strategies based on multidimensional feature analysis, which can achieve accurate attribution of strategy behavior in an encrypted environment.

[0005] To achieve the above objectives, the technical solution of the present invention includes the following:

[0006] An attribution method for encrypted DNS resolution strategies based on multidimensional feature analysis, the method comprising: Construct a policy behavior feature library for network entities, wherein the policy behavior feature library consists of abnormal response policy features for the network entity; Collect the target encrypted DNS resolver's resolution policy behavior for various domain names and the response data generated by that resolution policy behavior; Extract a target multidimensional feature vector from the response data; The target multidimensional feature vector is compared with the policy behavior feature library to attribute the parsed policy behavior to one or more network entities.

[0007] Furthermore, the resolution policy behavior of the target encrypted DNS resolver for various domain names is collected, including: Construct a list of probe domains, which includes security policy probe domains, performance policy probe domains, compliance policy probe domains, and anomaly handling probe domains. The security policy probe domains are malicious or illegal domains, the performance policy probe domains are legitimate content domains with traffic exceeding a set value, the compliance policy probe domains are domains with restricted access, and the anomaly handling probe domains are reserved or non-existent domains. The list of probed domain names is sent to the target encrypted DNS resolver to induce the target encrypted DNS resolver to exhibit the corresponding resolution policy behavior.

[0008] Furthermore, the target multidimensional feature vector includes: DNS protocol layer features, network layer features, and application layer association features. Specifically, the DNS protocol layer features include: DNS response codes, extended error codes, authoritative record flags, number of response records, and TTL value distribution; the network layer features include: the geographical location and type of the returned IP address, the autonomous system to which the IP address belongs and its organizational information, and PTR records; the application layer association features include: CNAME alias chains, and TLS certificate information, HTTP status codes, and page content fingerprints obtained through HTTP / S probing of the returned IP.

[0009] Furthermore, the network entity includes: network middleware, upstream DNS resolution service, and target encrypted DNS resolver; the policy behavior feature library includes: middleware policy feature library for network middleware, upstream service policy feature library for upstream DNS resolution service, and its own policy feature library for target encrypted DNS resolver.

[0010] Furthermore, the process of constructing the middleware strategy feature library includes: Simulate a scenario where a DNS query passes through a specific network middleware; Capture and analyze the strategic responses generated after the middleware is triggered; Extract the feature vector of this strategic response to construct a middleware strategy feature library.

[0011] Furthermore, the process of constructing the upstream service strategy feature library includes: Obtain the responses of various domain names from benchmark DNS services with known policies; Baseline feature vectors are extracted from the responses to construct a policy feature library mapped to specific upstream services.

[0012] Furthermore, the process of constructing the upstream service strategy feature library includes: Analyze the topological dependencies of template DNS resolvers to identify those recursive resolvers with consistent ingress and egress IP addresses or AS. Record the service exception response characteristics generated by the recursive resolver when processing domain names, and use them as its own policy feature library.

[0013] Furthermore, the target multidimensional feature vector is compared with a policy behavior feature library to attribute the parsed policy behavior to one or more network entities, including: Step 4.1: Match the target multidimensional feature vector with the middleware strategy feature library; Step 4.2: If the target multidimensional feature vector successfully matches the middleware policy feature library, then attribute the parsed policy behavior to the network middleware; if the target multidimensional feature vector fails to match the middleware policy feature library, then proceed to step 4.3. Step 4.3: Match the target multidimensional feature vector with its own strategy feature library; Step 4.4: If the target multidimensional feature vector successfully matches its own policy feature library, then attribute the parsing policy behavior to the target encrypted DNS resolver; if the target multidimensional feature vector fails to match its own policy feature library, then proceed to step 4.5. Step 4.5: Match the target multidimensional feature vector with the upstream service strategy feature library; Step 4.6: If the target multidimensional feature vector successfully matches the upstream service policy feature library, the resolution policy behavior is attributed to the upstream DNS resolution service; if the target multidimensional feature vector fails to match its own policy feature library, the policy attribution is output as uncertain; among which, the scenarios that lead to the output of uncertain policy attribution include: the policy implementer is not included in the feature library, the behavioral characteristics of the policy implementer have changed dynamically, and the response contains feature information that has been actively obfuscated or disguised.

[0014] Furthermore, if the target multidimensional feature vector successfully matches the upstream service strategy feature library, the method further includes: By building an authoritative server and embedding the resolver IP in the queried domain name, the upstream topology of the target encrypted DNS resolver is constructed; If the target encrypted DNS resolver depends on a successfully matched upstream DNS resolution service, then increase the confidence level of that upstream DNS resolution service; If the target encrypted DNS resolver does not rely on a successfully matched upstream DNS resolution service, then reduce the confidence of that upstream DNS resolution service.

[0015] A DNS resolution strategy attribution system based on multidimensional feature analysis, the system comprising: The feature library construction module is used to construct a policy behavior feature library for network entities, which consists of abnormal response policy features for the network entity. The response data collection module is used to collect the target encrypted DNS resolver's resolution strategy behavior for various domain names and the response data generated by the resolution strategy behavior; The feature vector extraction module is used to extract a target multidimensional feature vector from the response data; The policy behavior attribution module is used to compare the target multidimensional feature vector with the policy behavior feature library to attribute the parsed policy behavior to one or more network entities.

[0016] Compared with existing technologies, this invention can effectively attribute the source of abnormal service responses through external observation and analysis without directly accessing the internal logs or configurations of each node in the resolution link, thus overcoming the network opacity challenge brought about by encrypted DNS. Attached Figure Description

[0017] Figure 1 A flowchart of a DNS resolution strategy attribution method based on multidimensional feature analysis. Detailed Implementation

[0018] To enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, and to make the objectives, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments.

[0019] This invention achieves automated and refined attribution of policy behaviors by executing a standardized "probe-feature extraction-attribution" process. This method can be widely applied to scenarios such as encrypted DNS service quality monitoring, network fault diagnosis, security auditing, and compliance analysis, demonstrating high practicality and versatility.

[0020] Specifically, the DNS resolution strategy attribution method based on multi-dimensional feature analysis of this invention is applicable to source attribution and analysis of response inconsistencies in encrypted DNS environments, such as... Figure 1 As shown, it includes the following steps 1 to 4.

[0021] Step 1: Construct a policy behavior feature library for network entities.

[0022] To establish a benchmark capable of distinguishing the behavioral patterns of different implementing entities, this implementation method first constructs a multi-dimensional, multi-source policy behavior feature library. This library consists of abnormal response policy features for different responsible parties. These abnormal response policy features are used to quantitatively describe an abnormal service response, as shown in Table 1. They include: DNS response codes (RCODE), extended DNS error codes (EDE), returned IP address type (private IP / public IP), information about the Autonomous System (AS) to which the public IP belongs and its organization, PTR records, CNAME records, and TLS certificate information and Block Page content fingerprints obtained through HTTP / HTTPS probing of the returned IP address. Feature Name Data types describe Abnormal RCODE Numerical The rcode represents the DNS query status, excluding NOERROR. EDE code Numerical Extended DNS error codes indicating the cause of a DNS error No data Boolean type If rcode is NOERROR but the answer is empty, then the value is 1; otherwise, the value is 0. CNAME Category If a CNAME record is used, then the assigned alias domain name Private IP Category Specific private IP address used in DNS response Public IP Category AS organizations with open IP addresses in DNS responses PTR Recording Category Domain names associated with public IP addresses Block Page Category Fingerprint of the blocked page returned by a spoofed IP Laws and regulations Category Laws or regulations cited in HTTP content Table 1 In one embodiment, this invention constructs middleware policy feature libraries, upstream service policy feature libraries, and self-policy feature libraries for network entities such as network middleware, upstream DNS resolution services, and the target encrypted DNS resolver itself. For the middleware policy feature library, this invention sends queries for specific test domain names to IP addresses that do not provide DNS services within the Autonomous System (AS) network environment where the target resolver resides. If a response is received, its characteristics are considered as interference behavior characteristics of the middleware in that network environment and are recorded in the middleware policy feature library. For the upstream service policy feature library, this invention targets mainstream public encrypted DNS service providers (such as Cloudflare, Google, etc.) and analyzes their abnormal service response characteristics by conducting large-scale measurements of their responses to a list containing popular domain names and known specific test domain names (such as phishing domain names), establishing policy feature profiles for each upstream service provider and storing them in the upstream service policy feature library. For the self-policy feature library, this invention analyzes the topological dependencies of template DNS resolvers, identifies recursive resolvers with consistent entry / exit IP addresses or ASs, and records the abnormal service response characteristics they generate when processing the test domain name list, as part of the self-policy feature library.

[0023] Step 2: Collect the target encrypted DNS resolver's resolution strategy behavior for various domain names and the response data generated by the resolution strategy behavior.

[0024] For target encrypted DNS resolvers that require attribution analysis, response data for various domain names is collected through active probing or passive monitoring.

[0025] In a preferred embodiment, the present invention constructs a carefully crafted list of probe domain names to proactively induce a target encrypted DNS resolver to exhibit its internal resolution strategy behavior and collects the response data it generates. This list of probe domain names includes domain names designed to trigger different resolution strategies, and their types include: • Security policy probe domains: These are widely recognized malicious or illegal domains used to induce security filtering policies in resolvers; • Performance strategy detection domains: These are legitimate content domains with high global traffic, used to induce the resolver's caching, load balancing, and localization scheduling strategies; • Compliance policy detection domains: These are domains that may be restricted from access according to the laws and regulations of a specific region, used to induce the resolution server to implement compliance filtering strategies; • Exception handling probe domain: refers to a reserved or non-existent domain name used to guide the resolver to the default handling strategy for exception requests.

[0026] Step 3: Extract a target multidimensional feature vector from the response data.

[0027] In one embodiment, the target multidimensional feature vector described in this step includes DNS protocol layer features, network layer features, and application layer association features. The DNS protocol layer features include: DNS response codes, extended error codes, authoritative record flags, number of response records, and TTL value distribution. The network layer features include: the geographical location and type of the returned IP address, the autonomous system to which the IP address belongs and its organizational information, and PTR records. The application layer association features include: CNAME alias chains, and TLS certificate information, HTTP status codes, and page content fingerprints obtained through HTTP / S probing of the returned IP.

[0028] Step 4: Compare the target multidimensional feature vector with the policy behavior feature library to attribute the observed policy behavior to one or more network entities.

[0029] This invention matches the target's multidimensional feature vector with the middleware policy feature library, the upstream service policy feature library, and its own policy feature library, respectively. The matching algorithm can employ feature similarity calculations (such as cosine similarity or Jaccard coefficient) or rule-based matching based on specific key features (such as fingerprints of specific blocked pages or specific EDE codes). This step will output one or more highly probable candidate implementers.

[0030] Specifically, the present invention implements a systematic three-level attribution process, the logic of which is as follows.

[0031] (1) Middleware Attribution: First, the feature vector of the response to be analyzed is matched with the pre-built middleware policy feature library. If the match is successful, the abnormal service response is directly attributed to the corresponding network middleware.

[0032] (2) Self-attribution: If the match with the middleware feature library fails, analyze whether the target parser is a recursive parser and its response features. If the parser is determined to be a recursive parser, attribute this abnormal response to the target parser itself.

[0033] (3) Upstream service attribution: If neither of the above two steps matches, it indicates that the abnormal response was not generated by the local network or the resolver itself. In this case, the feature vector is matched with the pre-built upstream service policy feature library to infer the upstream DNS service that implemented the policy response.

[0034] In a preferred embodiment, the present invention further incorporates topological dependencies for attribution refinement. Specifically, to improve the accuracy of attribution, the present invention introduces contextual information of the resolver, particularly its upstream DNS dependencies (topology), to refine the initial attribution results. The present invention collects the upstream server addresses of the resolver by building its own authoritative server and embedding the resolver's IP address in the queried domain name, and further obtains the response policies of the upstream servers. If the characteristics of a response highly match the policy characteristic library of upstream service provider A, and the topology analysis results show that the resolver does indeed depend on upstream A, the confidence in attributing the inconsistency to upstream service A will be significantly improved. Conversely, if there is no dependency between the two, the probability of attributing it to upstream A will decrease.

[0035] Finally, this invention outputs the most likely perpetrator of the abnormal service response (the resolver itself, the upstream service, or the network middleware) and its confidence level, and can statistically analyze the proportion and scope of abnormal service responses caused by each perpetrator. Specifically, when the confidence levels of all most likely perpetrators are below a set threshold, the conclusion that the policy attribution is uncertain is output. Scenarios that lead to this uncertain policy attribution conclusion include situations where the policy implementer is not included in the feature database, the policy implementer's behavioral characteristics have dynamically changed, and the response contains actively obfuscated or disguised feature information.

[0036] The following is a scenario with significant attribution effect, which generates and outputs its attribution path representation. For example, the original logs contain the following service exception response: Entry resolver 1.2.3.4 queries example.com and returns 0.0.0.0 (EDE: 17); The Cloudflare-Family-DNS policy signature library contains {RCODE: NOERROR, IP: 0.0.0.0, EDE: 17}; The topology dependency shows that the upstream of version 1.2.3.4 is Cloudflare-Family-DNS.

[0037] Therefore, it can be attributed to: 1.2.3.4 -> Cloudflare-Family-DNS (upstream service policy filtering), and the output results can be used for quantitative evaluation of encrypted DNS service quality, rapid location of network faults, etc.

[0038] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail using examples, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for attributing encrypted DNS resolution strategies based on multidimensional feature analysis, characterized in that, The method includes: Construct a policy behavior feature library for network entities, wherein the policy behavior feature library consists of abnormal response policy features for the network entity; Collect the target encrypted DNS resolver's resolution policy behavior for various domain names and the response data generated by that resolution policy behavior; Extract a target multidimensional feature vector from the response data; The target multidimensional feature vector is compared with the policy behavior feature library to attribute the parsed policy behavior to one or more network entities.

2. The method according to claim 1, characterized in that, Collect the target encrypted DNS resolver's resolution policy behavior for various domain names, including: Construct a list of probe domains, which includes security policy probe domains, performance policy probe domains, compliance policy probe domains, and anomaly handling probe domains. The security policy probe domains are malicious or illegal domains, the performance policy probe domains are legitimate content domains with traffic exceeding a set value, the compliance policy probe domains are domains with restricted access, and the anomaly handling probe domains are reserved or non-existent domains. The list of probed domain names is sent to the target encrypted DNS resolver to induce the target encrypted DNS resolver to exhibit the corresponding resolution policy behavior.

3. The method according to claim 1, characterized in that, The target multidimensional feature vector includes: DNS protocol layer features, network layer features, and application layer related features; wherein, the DNS protocol layer features include: DNS response codes, extended error codes, authoritative record flags, number of response records, and TTL value distribution; the network layer features include: the geographical location and type of the returned IP address, the autonomous system to which the IP address belongs and the organizational information of the autonomous system, and PTR records; the application layer related features include: CNAME alias chains, and TLS certificate information, HTTP status codes, and page content fingerprints obtained by performing HTTP / S probing on the returned IP.

4. The method according to claim 1, characterized in that, The network entities include: network middleware, upstream DNS resolution service, and target encrypted DNS resolver; the policy behavior feature library includes: middleware policy feature library for network middleware, upstream service policy feature library for upstream DNS resolution service, and self-policy feature library for target encrypted DNS resolver.

5. The method according to claim 4, characterized in that, The process of constructing the middleware strategy feature library includes: Simulate a scenario where a DNS query passes through a specific network middleware; Capture and analyze the strategic responses generated after the middleware is triggered; Extract the feature vector of this strategic response to construct a middleware strategy feature library.

6. The method according to claim 4, characterized in that, The process of building an upstream service strategy feature library includes: Obtain the responses of various domain names from benchmark DNS services with known policies; Baseline feature vectors are extracted from the responses to construct a policy feature library mapped to specific upstream services.

7. The method according to claim 4, characterized in that, The process of building an upstream service strategy feature library includes: Analyze the topological dependencies of template DNS resolvers to identify those recursive resolvers with consistent ingress and egress IP addresses or AS. Record the service exception response characteristics generated by the recursive resolver when processing domain names, and use them as its own policy feature library.

8. The method according to claim 4, characterized in that, The target multidimensional feature vector is compared with a policy behavior feature library to attribute the parsed policy behavior to one or more network entities, including: Step 4.1: Match the target multidimensional feature vector with the middleware strategy feature library; Step 4.2: If the target multidimensional feature vector successfully matches the middleware policy feature library, then attribute the parsed policy behavior to the network middleware; if the target multidimensional feature vector fails to match the middleware policy feature library, then proceed to step 4.

3. Step 4.3: Match the target multidimensional feature vector with its own strategy feature library; Step 4.4: If the target multidimensional feature vector successfully matches its own policy feature library, then attribute the parsing policy behavior to the target encrypted DNS resolver; if the target multidimensional feature vector fails to match its own policy feature library, then proceed to step 4.

5. Step 4.5: Match the target multidimensional feature vector with the upstream service strategy feature library; Step 4.6: If the target multidimensional feature vector successfully matches the upstream service policy feature library, the resolution policy behavior is attributed to the upstream DNS resolution service; if the target multidimensional feature vector fails to match its own policy feature library, the policy attribution is output as uncertain; among which, the scenarios that lead to the output of uncertain policy attribution include: the policy implementer is not included in the feature library, the behavioral characteristics of the policy implementer have changed dynamically, and the response contains feature information that has been actively obfuscated or disguised.

9. The method according to claim 8, characterized in that, If the target multidimensional feature vector successfully matches the upstream service strategy feature library, the method further includes: By building an authoritative server and embedding the resolver IP in the queried domain name, the upstream topology of the target encrypted DNS resolver is constructed; If the target encrypted DNS resolver depends on a successfully matched upstream DNS resolution service, then increase the confidence level of that upstream DNS resolution service; If the target encrypted DNS resolver does not rely on a successfully matched upstream DNS resolution service, then reduce the confidence of that upstream DNS resolution service.

10. An attribution system for encrypted DNS resolution strategies based on multidimensional feature analysis, characterized in that, The system includes: The feature library construction module is used to construct a policy behavior feature library for network entities, which consists of abnormal response policy features for the network entity. The response data collection module is used to collect the target encrypted DNS resolver's resolution strategy behavior for various domain names and the response data generated by the resolution strategy behavior; The feature vector extraction module is used to extract a target multidimensional feature vector from the response data; The policy behavior attribution module is used to compare the target multidimensional feature vector with the policy behavior feature library to attribute the parsed policy behavior to one or more network entities.

Images