Boosting practicality of DNS cache probing: A general estimator based on Bayesian forecasting

It is an important task in Internet demography and security monitoring to accurately measure the user population of an application in a network. In previous works, the Domain Name System (DNS) cache probing technique was proposed to estimate λ̅, the average DNS querying rate for a domain name associated with the given application. One can readily obtain the user population given another empirical parameter from DNS traces, i.e., average number of DNS queries per user. The previous estimator for λ̅ was based on the assumption that the DNS query arrivals can be described by a homogeneous Poisson process. In this paper, we verify this assumption by measuring real DNS traces and find that it is over-simplified. In fact, the DNS query arrivals exhibit non-stationary property dominated by a diurnal pattern in general, thereby making the previous estimator underestimate λ̅. Then, an asymptotically unbiased estimator is proposed using the Bayesian forecasting. The proposed estimator is more general as compared with the previous one because it can accurately estimate λ̅ when the DNS query arrivals can be described by either homogeneous or non-homogeneous Poisson processes. The proposed estimator meets the minimum mean squared error principle, and the experimental results show that it significantly outperforms the previous one. The DNS cache probing technique offers promising applications because it is low-cost, less invasive and privacy preserving. Our work greatly boosts the practicability of this technique.