Graph Theoretical Models of DNS Traffic

The DNS is one of the core protocols on which the Internet is built upon. Hidden behind higher-level protocols such as email and web, it carries valuable information that can be exploited for understanding trends and preferences of the Internet community. In this paper we propose novel methodologies for modelling DNS traffic that allow Internet domains, DNS resolvers and their interactions to be represented effectively by means of graphs. DNS traffic collected at ".it" ccTLD DNS domain servers has been used to validate this work on a large scale. We found highly-skewed, fat-tailed domain and resolver degree frequencies, obeying power laws at least in their tails. These findings shed light on the the scale-free nature of the DNS ecosystem, where a few domains and a few resolvers are responsible for most of the DNS activity.