Subject: [dns-privacy] "SFMap: Inferring Services over Encrypted Web Flows Using Dynamical Domain Name Graphs"

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 19 Dec 2016 17:06:45 +0100

This research (still under embargo) seems relevant to this working group:

 Most modern Internet services are carried over the web. A significant
 amount of web transactions is now encrypted and the transition to
 encryption has made it difficult for network operators to understand
 traffic mix. The goal of this study is to enable network operators to
 infer hostnames within HTTPS traffic because hostname information is
 useful to understand the breakdown of encrypted web traffic. The
 proposed approach correlates HTTPS flows and DNS
 queries/responses. Although this approach may appear trivial, recent
 deployment and implementation of DNS ecosystems have made it a
 challenging research problem; i.e., canonical name tricks used by
 CDNs, the dynamic and diverse nature of DNS TTL settings, and
 incomplete measurements due to the existence of various caching
 mechanisms. To tackle these challenges, we introduce domain name
 graph (DNG), which is a formal expression that characterizes the
 highly dynamic and diverse nature of DNS mechanisms. Furthermore, we
 have developed a framework called Service-Flow map (SFMap) that works
 on top of the DNG. SFMap statistically estimates the hostname of an
 HTTPS server, given a pair of client and server IP addresses. We
 evaluate the performance of SFMap through extensive analysis using
 real packet traces collected from two locations with different
 scales. We demonstrate that SFMap establishes good estimation
 accuracies and outperforms a state-of-the-art approach.

https://hal.archives-ouvertes.fr/hal-01411189v1