Passive OS fingerprinting by DNS traffic analysis

T Matsunaka, A Yamada… - 2013 IEEE 27th …, 2013 - ieeexplore.ieee.org
T Matsunaka, A Yamada, A Kubota
2013 IEEE 27th International Conference on Advanced Information …, 2013ieeexplore.ieee.org
In this paper, we propose a new passive OS fingerprinting method which only requires DNS
traffic analysis. The method utilizes characteristics on DNS queries specific to each OS, eg
unique domain names, query patterns, time interval etc. The method can estimate the
number of devices with each OS from the number of queries by utilizing the characteristics of
the time interval patterns. The method considers the likelihood of irregular events that some
queries are sent at less than regular time intervals, and some other queries are sent at more …
In this paper, we propose a new passive OS fingerprinting method which only requires DNS traffic analysis. The method utilizes characteristics on DNS queries specific to each OS, e.g. unique domain names, query patterns, time interval etc. The method can estimate the number of devices with each OS from the number of queries by utilizing the characteristics of the time interval patterns. The method considers the likelihood of irregular events that some queries are sent at less than regular time intervals, and some other queries are sent at more than regular time intervals. We analyze DNS traffic sent by each OS and extract the characteristics for OS fingerprinting. Then, we examine our estimation method by using DNS traffic in our intra-network. According to our examination, some results of our estimation method are close to the results of DHCP fingerprinting.
ieeexplore.ieee.org