Enabling Entangled Cache Probing for Remotely Reconstructing DNS Query Dynamics

The domain name system (DNS) is indispensable to nearly every Internet service. It has been extensively utilized for network activity characterization in passive and active approaches. Compared to the passive approach, active DNS cache probing is lightweight and non-cooperative, enabling world-wide characterization of remote network activities in different networks. Unfortunately, existing probing-based methods are too coarse-grained to characterize the time-varying features of network activities, substantially limiting their applications in time-sensitive tasks. In this paper, we advance DNSScope, a temporally fine-grained DNS cache probing framework by addressing three key challenges: cache entanglement, sample sparsity, and observational distortion. DNSScope introduces three novel probing strategies, extending active DNS cache probing from single-cache to heterogeneous recursive DNS (R-DNS) resolvers. It synthesizes statistical learning and transfer learning to achieve time-varying characterization of remote network activity. Extensive evaluations demonstrate DNSScope’s adaptability for R-DNS resolvers with diverse cache structures and its effectiveness in accurately estimating time-varying DNS query arrival rates, achieving an average mean absolute error of 0.124, as low as one-sixth that of the baseline methods. We also demonstrate DNSScope’s application to network anomaly detection.