大规模DNS解析行为分析和应用研究

DNS承载着域名与IP地址间相互映射重任。分析DNS解析行为是掌握DNS基础设施特征，认识内容承载设施特征，发现潜在安全风险，并进行相关优化的重要手段。然而，DNS规模越来越大，域名的作用越来越多样化，域名到地址映射的动态性也越来越强，这给DNS解析行为的精准刻画带来了巨大挑战。本项目将利用大规模主被动DNS解析行为测数据集，首先研究基于域名结构和关联特征的恶意域名、跟踪域名等的识别和分类方法，其次刻画各类域名DNS解析行为特征，特别是解析失效行为及其根因量化；再次分析各类域名的内容承载设施特征，特别是主要CDN和云承载提供方时空特征；最后应用分析结果，从内容部署、安全隐私与DNS流量等角度优化网络。项目组长期从事大规模互联网测量和优化，收集了覆盖全国的大规模DNS解析数据，并部署了上万台主动测量节点。项目预期成果将为DNS应对5G海量终端接入、内容承载设施升级、安全隐私增强提供科学依据。

DNS maps between domain names and IP addresses. Analyzing DNS resolution behavior is an important means to grasp the characteristics of DNS infrastructure, to recognize the characteristics of content-bearing facilities, to discover potential security risks, and to perform possible optimizations. However, the scale of DNS infrastructure is getting larger and larger, the role of domain names is becoming more and more diverse, and the dynamics of mapping between domain name and address are becoming stronger and stronger, which brings great challenges to the accurate description of DNS resolution behavior. ..This project will use a large-scale active and passive DNS resolution behavior measurement dataset, first to study the identification and classification methods of malicious domain names and tracking domain names based on domain name structure and associated characteristics, and secondly to describe the DNS resolution behavior characteristics of various domain names, especially the resolution failure quantify the behavior and its root causes; again analyze the characteristics of content hosting facilities of various domain names, especially temporal and spatial characteristics of the main CDN and cloud hosting providers; finally apply the analysis results to optimize the network from the perspectives of content deployment, security and privacy, and DNS traffic. ..The project team has long been engaged in large-scale Internet measurement and optimization, collected large-scale DNS resolution data covering the whole country, and deployed tens of thousands of active measurement nodes. The project's expected results will provide a scientific basis for DNS's response to 5G massive terminal access, content carrying facility upgrades, and security and privacy enhancement.