DNS Graph Name Identification for Encrypted CDN Services
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for identifying communication service types in encrypted HTTP flows and CDN services face challenges due to caching of DNS responses and the use of aliases, leading to inaccurate inference of host names.
Innovation Solution
A name identification device generates graph information from DNS responses, associating names and IP addresses, and uses this information to identify service names by tracing edges in the graph, even when aliases are used, thereby improving the accuracy of host name inference.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If DNS response caching is implemented, then network efficiency is improved, but host name accuracy deteriorates due to expired or invalid names
Solution Approach 1:
The system performs preliminary actions by generating graph information from DNS responses in advance and storing it for later use. When identifying host names for encrypted flows, the system traces through the pre-built graph to find valid host names, rather than relying on potentially expired cached DNS responses. This allows the system to maintain both caching efficiency and name accuracy.
2Adaptability or versatility
If CDN services with CNAME aliases are used, then service delivery flexibility is improved, but service identification accuracy deteriorates due to alias names
Solution Approach 1:
The system transitions from a simple linear DNS response storage to a multi-dimensional graph structure where nodes represent host names, IP addresses, and CNAME aliases, and edges represent their relationships. This graph structure allows the system to traverse through CNAME aliases and CNAME chains to reach the original service host name, effectively resolving the identification accuracy issue while maintaining CDN flexibility.
3Device complexity
If only latest DNS response is managed, then data storage simplicity is improved, but name resolution accuracy deteriorates when aliases are involved
Solution Approach 1:
The system implements a nested structure where the graph information contains multiple levels of host name relationships. CNAME aliases are nested within the graph as intermediate nodes, and the system can traverse through these nested layers to reach the original service name. This nested approach allows comprehensive name resolution while maintaining organized data storage.
Data Source
AI summary
A name identification device includes a generation unit configured to generate graph information in which each node represents one of names and IP addresses included in A records and CNAME records included in a DNS response observed in a network, and each edge represents a correspondence relationship between one and another of the names and the IP addresses in the A records and the CNAME records, and to associate the generated graph information with a client corresponding to the DNS response; and an identifying unit configured to identify a name related to a leaf node that is reachable from a node corresponding to the IP address of a server by tracing the edges in the graph information having been associated with the client, for a packet between the client and the server that is observed in the network.