Research Article
DualDNSMiner: A Dual-Stack Resolver Discovery Method Based on Alias Resolution
@INPROCEEDINGS{10.1007/978-3-031-54531-3_19, author={Dingkang Han and Yujia Zhu and Liang Jiao and Dikai Mo and Yong Sun and Yuedong Zhang and Qingyun Liu}, title={DualDNSMiner: A Dual-Stack Resolver Discovery Method Based on Alias Resolution}, proceedings={Collaborative Computing: Networking, Applications and Worksharing. 19th EAI International Conference, CollaborateCom 2023, Corfu Island, Greece, October 4-6, 2023, Proceedings, Part III}, proceedings_a={COLLABORATECOM PART 3}, year={2024}, month={2}, keywords={DNS IPv6 dual-stack resolver alias resolution}, doi={10.1007/978-3-031-54531-3_19} }- Dingkang Han
Yujia Zhu
Liang Jiao
Dikai Mo
Yong Sun
Yuedong Zhang
Qingyun Liu
Year: 2024
DualDNSMiner: A Dual-Stack Resolver Discovery Method Based on Alias Resolution
COLLABORATECOM PART 3
Springer
DOI: 10.1007/978-3-031-54531-3_19
Abstract
With the rapid development of IPv6 network applications, the transition to IPv6 dns has accelerated. In this process, dual-stack resolvers take on the crucial role that ensures the resolution of domains under hybrid network conditions. However, the lagging deployment of IPv6 defence measures may undermine the overall security of resolvers, making the discovery of dual-stack resolvers vital for DNS security analysis. Previous methods for discovering dual-stack resolvers are built on strong but impractical assumptions, ignoring resolvers with multiple alias IP addresses. In this article, we propose a new dual-stack resolvers discovery model based on alias resolution - DualDNSMiner. DualDNSMiner involves address alias resolution technology in order to recognize hosts with multiple alias addresses and identify dual-stack resolvers. Large-scale measurement experiments show that, DualDNSMiner can reliably discover over 80% more new dual-stack resolvers compared to previous judgment rules. In addition, we put forth a novel approach to validate the accuracy of our findings. The results demonstrate that the precision of DualDNSMiner can exceed over 90%. Finally, the results of DualDNSMiner provide the first proof of the widespread use of alias addresses in DNS resolvers, which is crucial for analyzing the process of DNS’s IPv6 evolution.
