DNS fingerprint based on user activity.

Area of Science:

• Computer Science
• Network Security
• Machine Learning

Background:

• The Domain Name System (DNS) is fundamental to Internet operations, resolving domain names for user activities.
• Understanding user behavior within DNS traffic is crucial for network analysis and security.
• Previous methods often relied on stable IP addresses, limiting their applicability.

Purpose of the Study:

• To investigate if unique user fingerprints can be derived from DNS query behavior.
• To assess the feasibility of user identification solely based on DNS traces, irrespective of IP address stability.
• To evaluate the effectiveness of various machine learning models for DNS-based user classification.

Main Methods:

• Utilized a public dataset of real DNS traffic from a large-scale network.
• Compared machine learning models: Naive Bayes, Random Forests, XGBoost, Multilayer Perceptrons, and Convolutional Neural Networks (CNNs).
• Employed data preprocessing, dimensionality reduction, and feature selection to optimize classification.

Main Results:

• The Convolutional Neural Network (CNN) model achieved the highest classification accuracy of 86.7%.
• User identification was successful across 1727 unique IP addresses, demonstrating robustness.
• The findings confirm the viability of DNS-based user fingerprinting, even with dynamic IP addresses.

Conclusions:

• DNS query patterns can serve as reliable user fingerprints for identification.
• This technique enhances capabilities in network forensics and anomaly detection.
• The study highlights the need for careful consideration of privacy and ethical implications in passive traffic analysis.