How Many Users Behind A Local Recursive DNS Server? Estimated by Delta-Time Cluster Model

The plain requests of Domain Name System (DNS) reflect users’ behavioral characteristics. The user-volume behind a Local Recursive DNS Server (LRDNS) contributes many applications, such as online advertisement and network management. However, when the vantage point is outside of the target LRDNS, recent methods can’t measure the user-volume well. In this paper, we propose a delta-time cluster model UVM (User-Volume Measurement). Through capturing the DNS traffic from the target LRDNS outside, UVM recovers the cache compressed requests to simulated original requests. It clusters simulated original requests to estimate the lower/upper bound of the LRDNS’s user-volume. Our experiments in one company-type Local Area Network (LAN) demonstrate that the error rate between the estimated value from UVM and the actual value can be within 3%.