Measurement and Analysis of Domain Access Patterns Based on Large-scale DNS Recursive Services

The performance and operational characteristics of the domain name system (DNS) protocol continue to attract significant attention from both the research community and network operators. In this study, data collected from a large-scale DNS recursive service is measured and analyzed to examine user access patterns and resolution behavior from the perspective of a major DNS operator. To handle the massive volume of DNS data, this study proposes a distributed parallel measurement mechanism and a big data-based storage and monitoring solution, enabling efficient processing and analysis. The characteristics of DNS data are systematically examined across several dimensions, including user request response rates, domain name request patterns, user distribution, and resolution outcomes. Several valuable insights are presented, offering meaningful guidance for DNS operation optimization and improved understanding of DNS behavior. Finally, based on the analysis of DNS cache hit rates, this study proposes a general framework for online anomaly detection tailored to large-scale DNS operators. The correctness and feasibility of the proposed framework are preliminarily verified.