基于DNS流量的多层多域名检测与测量

为了研究DNS流量中的域名角色，为域名影响力分析提供一种域名定位和筛选的思路，设计一种基于DNS流量的多层多域名检测算法. 在检测阶段，从CERNET主干网边界采集DNS流量，提取请求和应答序列. 基于多层多域名的聚合特征及解析的并发性，检测流量中存在的主从域名集合，并引入时间滑动窗口机制进行置信度测量. 在测量阶段，对算法检测结果从多个角度进行分析，包括多层多域名集合的规模和相交情况、主从域名的标签级数、集合中从域名对应的资源类型等，并提供了2个存在多层多域名的典型网站案例. 测量结果验证了多层多域名现象的存在以及多层多域名集合的特点，表明了此多层多域名检测算法的有效性.

Multi-layer domain name detection and measurement based on DNS traffic

A multi-layer domain name detection algorithm based on DNS traffic was designed to give a further study to the role of domain in DNS traffic and provide a method for domain’s influence analysis. In the detection stage, DNS traffic was collected from the boundary of the CERNET backbone, then request and response sequences were extracted. Based on the aggregation characteristic of multi-layer domain name and the concurrency of DNS resolution, the sets of parent-child domains in traffic were detected, and a time sliding window mechanism was introduced to measure the results' confidence. In the measurement stage, the detection results were analyzed from multiple perspectives, including the scale and intersection of multi-layer domain name sets, the number of tags of parent-child domain and the resource type of child domain in the set, etc. Then two cases of typical websites with multi-layer domain name were provided. The measurement results verified the existence and characteristics of multi-layer domain name and showed the effectiveness of the algorithm.