Increased demand for DNS privacy has driven the creation of several encrypted DNS protocols, such as

(DoH), DNS over TLS (DoT), and DNS over QUIC (DoQ). Recently, DoT and DoH have been deployed by some vendors like Google and Cloudflare. This paper addresses privacy leakage in these three encrypted DNS protocols (especially DoQ) with different DNS recursive resolvers (Google, NextDNS, and Bind) and DNS proxy (AdGuard). More particularly, we investigate encrypted DNS traffic to determine whether the adversary can infer the category of websites users visit for this purpose. Through analyzing packet traces of three encrypted DNS protocols, we show that the classification performance of the websites (i.e., user's privacy leakage) is very high in terms of identifying 42 categories of the websites both in public (Google and NextDNS) and local (Bind) resolvers. By comparing the case with cache and without cache at the local resolver, we confirm that the caching effect is negligible as regards identification. We also show that discriminative features are mainly related to the inter-arrival time of packets for DNS resolving. Indeed, we confirm that the F1 score decreases largely by removing these features. We further investigate two possible countermeasures that could affect the inter-arrival time analysis in the local resolver: AdBlocker and DNS prefetch. However, there is no significant improvement in results with these countermeasures. These findings highlight that information leakage is still possible even in encrypted DNS traffic regardless of underlying protocols (i.e., HTTPS, TLS, QUIC).

抄録全体を表示

The number of IoT devices connected to the Internet has been rapidly increasing. On the other hand, some IoT devices may not have sufficient security capabilities because they do not have enough resources. Previous work to monitor IoT device traffic used a monitoring node running packet sniffing software, but it required an extensive resource. We propose new IoT traffic monitoring method which utilizes DNS name resolution. Our method not only decrease CPU resources, but also prevent suspicious communication from IoT devices. We implemented the prototype to verify the proposed method can detect and prevent suspicious communication with lower CPU load.

抄録全体を表示