University of Twente Student Theses

Login

Profiling Recursive Resolvers at Authoritative Name Servers

Açikalin, M.A. (2019) Profiling Recursive Resolvers at Authoritative Name Servers.

[img] PDF
6MB
Abstract:Domain Name System (DNS) translates a computer's fully qualified domain name into an IP address. Intermediary machines so-called recursive resolvers do this translation between a client and a DNS server. There are many recursive resolvers which connect to name servers every day. Each resolver show similarities and differences from one another. Knowing the origins of recursive resolvers can help to monitor significant operational changes in the DNS system and can be further used to prioritise some resolvers in case of DDoS attacks. There is too less study in the field which focuses on profiling them. In this thesis, standard behaviours of recursive resolvers and their behaviours in the wild are explained in detail. In addition, different classification methods applied to a data set consisted of 15 features to be able to classify recursive resolver origins in the case of .nl name servers. Random forest classifier had a 91\% of overall accuracy predicting different resolver types on the dataset. According to the results of classification, more than 50\% of unique resolvers contacting .nl name servers are originating from Internet Service Providers (ISPs). This is followed by open resolvers and cloud originating resolvers with around 10\% and 7\% respectively.
Item Type:Essay (Master)
Faculty:EEMCS: Electrical Engineering, Mathematics and Computer Science
Subject:54 computer science
Programme:Computer Science MSc (60300)
Link to this item:http://purl.utwente.nl/essays/79267
Export this item as:BibTeX
EndNote
HTML Citation
Reference Manager

 

Repository Staff Only: item control page