论文标题
基于DNS的软件指纹的管道
A Pipeline for DNS-Based Software Fingerprinting
论文作者
论文摘要
在本文中，我们介绍了Donut的模块化设计和实现，Donut是一种新颖的工具，用于识别设备上运行的软件。我们的工具使用基于规则的方法在被动监控的DNS流量中检测特定于软件的DNS指纹（存储在易于扩展的数据库中）。我们在Atlas的帮助下自动化了甜甜圈的规则提取过程，这是我们开发的一种新颖的工具，用于通过创建它的软件为网络流量标记网络流量。我们通过为多个应用程序生成规则，评估分析的性能和可扩展性，并使用人工数据集确认甜甜圈的功能正确性来证明管道的功能。此外，我们对Donut的分析结果评估了具有未知地面真相的大型现实世界数据集。
In this paper, we present the modular design and implementation of DONUT, a novel tool for identifying software running on a device. Our tool uses a rule-based approach to detect software-specific DNS fingerprints (stored in an easily extendable database) in passively monitored DNS traffic. We automated the rule extraction process for DONUT with the help of ATLAS, a novel tool we developed for labeling network traffic by the software that created it. We demonstrate the functionality of our pipeline by generating rules for a number of applications, evaluate the performance as well as scalability of the analysis, and confirm the functional correctness of DONUT using an artificial data set for which the ground-truth is known. In addition, we evaluate DONUT's analysis results on a large real-world data set with unknown ground truth.
