Inferring(Services(over((Encrypted(Web(FlowsğSoJčVĶÜ:P((EB:7:71)(
2014_320((ĶĐ?((Ì·PV)ƣ Ķ ((JST(ERATO)(ã(1)(web( ¾ŗŭƟſƠƈƂƅƅƙƍŬƂųŗM0((ıWIDE(Mawi(Project(hMp://mawi.wide.ad.jp,(samplepoint(B,(F(ŗŴƙƍũe¶
2002/12/1

P2Pľ

¾

2012/12/1Webľ¾ŭƟſƠƈƂƅŗOŁŗŸƠƌżľ(Web(hMp)(ŖÉìĨã(2)(web(čŗ90ïĤâcŜ14 %ŗAndroid(ŗčũ6ę÷«ņŋÚũĜ÷(hMps(hMp(IN(OUT(SSL/TLS(ŖţŎő90ńŧőĹŦHTTPč(HTTPS)ŗ,:ľĥĹ(ĲŽƠźƕƛƈƂƅƞƠųŢŰƟƙŭƟżƅƜƠŻÑŗ(ƊƠŽƇƛŕoJũċ7ŇŦūƏƚŵƠźƘƟŗL.

ĩŭƟſƠƈƂƅƅƙƍŬƂų÷«(ŗÀ½œþģ• À½ƥĦƅƙƍŬƂų"ûŗx~(– )j[Ăx~ƥ^Hŗ©ŖũƍŬƛſƠ[ĂœŇŧřţĹĽ(• 2Ŗ(HTTP(ŒŘÔDľaŇŀŦ(– Ġòŗx~ƥŔŗţĺŕūƏƚŵƠźƘƟŖ[ŇŦò¥ľĥĹŗĽƧ(Ķ→ūƠŲƃųƁƕŗøơŲƕƂźƖŗúßŢWAN(đ0ÑƢ(ıĹňŧšŅŎŁťœņŋÛ÷ľĸŧř1%(• þģƥĦ UūƏƝƠƁŗě¸ũ(– ƒƠƅ¹9ŒŘoJĔľ\ŕŇŀŦ(– ŸƠƉŗIPūƆƜżŒŘ1%ơżƙŭƆƢ(– DPI(ŗě¸:(SSL/TLS((¶Ŗ(HTTP(ƐƂƀľ5¯ŒĿŕĹ(ĪŸƠƉŗIPūƆƜżŒŘ1%ŕ• ČeĿũúXņőĹŕĹŵƠżľUF(• ñŗ(FQDN(ľŚœŏŗIPūƆƜżŒŨŧőĹŦŵƠż(((ƑżƃŬƟŴŢCDN(Ñ)(īÅÎŗŷƠƛ• ŭƟſƠƈƂƅƅƙƍŬƂųũµsņőĹŦWeb
ūƏƚŵƠźƘƟơƦŸƠƌżƢũx~ŇŦ(– °Ŗ90(Web(čũ[ĂœŇŦ(– 100%(ŗÕbũÀ{ŇšŗŒŘŕĹ(• 3´½ŖCĞĶĲĶŅŎŁťœņŋÛ÷ŗx~(ĬDNS(ųůƚũ¶ĹŋūƏƝƠƁčŗĘRŖÏŎőĦųƙŭūƟƅĽŤDNS(ŗ<+ö¦ľ»µŇŦŗŒƣŊŗoJũ¶ĹŧřƑżƅ<(FQDN)Ř
ŨĽŦ(DNSŸƠƉwww.apple.com?(Ĳ(61.213.146.4(from(10.1.2.3(ųƙŭūƟƅ(C1
10.1.2.3

61.213.146.4:443(Ĳ(10.1.2.3:31587((=(www.apple.com((APPLE)

HTTPSŸƠƉ(S1
61.213.146.4((akamai)(
NTT:COMĭUÅÎ:(DN(Hunter• Bermudez(et(al.,(“DNS(to(the(Rescue:(Discerning(Content(and(Services(in(a(Tangled(Web”,(ACM(IMC(2012ĶıEġŘùÿţťe¶ĮUÅÎœ}u§ŗ£Ć
DN(Hunter}u§%÷«[mĳĴÛ÷½|XĵĶ(óŋšŗľŇŜő)
ĴĶ(óőŕĹšŗš|X)

ƋƂƅņŕĽŎŋK:ŖļĹőšď4ŗõ«ũšœŖ(Û÷½Ŗ|XŇŦ¬ľôŕūŭƄŬūį}u§ŗ(1)(DNS(ųůƚoJũVàFQDN(3)(éķŕƋƖƠƚżƃŬƂų(FQDN(!((ŸƠƌż<|X()(mail.google.com(!(Google(mail(2)(FQDNũ|Xİ}dŗò((1):(VàĦ• ŸƠƉIPūƆƜż:(s(• ųƙŭūƟƅIPūƆƜż:(c(• *:(t((È2œŇŦ)(• DNS(A(ƜŶƠƆ(query(ŖļłŦ(FQDN:(N(œņŋœĿ((ĶĶ{s,c,t}(!(N(ųƙŭūƟƅ(ĶĶ{s,c}(!(N(cĶĶ{s}(!(N(ŗŇŜőũĎpē&Ŗ¼ĕ(ıQuery(response(Œñ(A(ƜŶƠƆũiŋŤ(ĶĶĶĶĶĶŇŜő¼ĕDNSŸƠƉQuery(=(N(Answer(=(s*(t*(t’HTTPSŸƠƉ(sĨħ}dŗò((2):(|X• |Xŗ[ĂœŕŦ(HTTPS(ƍƝƠŗ({s,(c,(t’}(ũy$(• ŭŴŹųƅƓƂƁ(– {s,(c,(t’}(Ŗ[ŇŦ(N(ũ$-(• ęňŤņ×(– Exact(match(ľQņŋK:ƣ{s,(c,(t’}(ŗ(t’(ũªŤņŕľŤ×((t’(=(t’,(t’:1,(t’:2,(…,(t’:m)(• DNS(ųůƚľ(HTTP(čĘRŖÏŎő»µŇŦŵƠżľĸŦ(• Û÷½|X((MAP)(– ùĹňŧšQņŋK:ƣ{s,c}(ĸŦĹŘ({s}(ŗŞũŎő]šŤņĹFQDN(ũÛ÷½Ŗ|XơP hÆ²|XƢĨĨPhÆ²|X((MAP)

●{s,(c}(ŗųůƚŖ[ŇŦmÒ(N={n1,(n2,(…,}(ŗ"ƣ]šŤņĹFQDNũùŗţĺŖ|X((((ĸŦĦFQDN(Ŗ[ņő((s,(c)(ŗÙŞ:Ũŉľ($³ŇŦÆ²(ĸŦĦFQDN(ŗ$³Ģb(ŸƠƌżŗ ¤b●{s,(c}(ŗųůƚŖ[ŇŦmÒľŕĹK:Řųůƚũ({s}(œņő;Ŗ|X(((ıĶPĨĩhÆ²ŗ÷ÓŖŘĹŁŏĽŗƉƚůƠźƘƟľáĻŤŧŦ}dŗò((3):(ŸƠƌż|X
• FQDN(ũgsŇŦT&ŗ°kŖšœŐĿƣŸƠƌżũ|X(• Public(suﬃx(ũy$(– www.ieice.org(ŗ(public(suﬃx(=(ieice.org((• ¡ťŗT&Ŗ[ņő°k½ŕT&ŗ­ũ'X(– mail,(blog,(planorm,(ad,(Ñ(ĨĪnäýYĤ• Ö2,000ŗÐľčũņőĹŦAÝũ÷«(• 90ńŧőĹŕĹ(HTTP(čũ(¶(– Request(header(ĽŤÂŗ(FQDN(ũy$8ä(– HTTP(ƚųůżƅ:(30084(– ę(=(Ö4000È(• DNSųůƚ(– ù(HTTP(čŗę^ũ>ş46000È(– Ö10ųůƚ(•AŗYĤýŒŘ|XÚũŗţĺŖK:%łũŇŦ(– |XFQDNœÂŗFQDN(ľW– Public(suﬃx(ľç((SIM)(– ŊŧN((NG)(ç((OK)(Ĩīfrac%on

ƊƙƔſ(m(œ×Õb
100%(90%(80%(70%(60%(50%(40%(30%(20%(10%(0%(sim(MAP)(sim(qme_shis)(sim(exact)(ok(MAP)(ok(qme_shis)(0(1(10(60(m

300( 3600(ok(exact)(ı(x(ąŘÝgŒŘŕĹŃœŖ¨qm(ŖZŤňOK(Ř(90%ƣSIM(ľ(5%(ËbŗÕb(m(=(0((ęňŤņ×ŕņ)ŒšÕbŘèĹ((MAPŗ|XÚľ)(m(ũLŢŇœęňŤņ×ŗ|XÚľœŕŦľÚŘ;ĨĬƊƙƔſ(m(œ×Ŷżƅ
total+lookup+%me+(sec)

25(20(15(10(5(0(0(1(10(60(m

300(3600(ı(x(ąŘÝgŒŘŕĹŃœŖ¨qm(ŗL.œœšŖ×ŶżƅľĥŝŦ(ĨĭůƙƠŗ3B• õ«ƄƠſĄ(– õ«ę"Ŗõ«ņŋweb(ŸƠƉŗ(IP(ūƆƜżũ>şDNSųůƚľ»µņŕĹK:Ř|XŗņţĺľŕĹ(• ;*Ŗ»µŇŦ({s,c,t}(ŗſƏƛ(– ³FŘ(t(ũÈ2ŖŝŦŠőĹŦľƣšĺ\ņØĽĹę%öäľlò(ĶĶ)(googleads.g.doubleclick.net(œ((ĶĶĶĶpagead2.googlesyndicaqon.com(ľ;ŗ({s,c,t}(ũzŏ(– ŔōŤš(CNAME(=(pagead46.l.doubleclick.net(ĨĮŝœŠœ hŗþģ• ď4ŗ(DNS(ųůƚũ5¯ņő90(Web(čŗŸƠƌżũ|XŇŦu§ũ}(• ÕbŘW çľ(90%ƣpublic(suﬃx(çľ5%Ëb(• MAP(ũĺŃœŒ×ŶżƅũÃÞ8ä(• þģ((1)(Õb=(– ėęƄƠſŗ6ťĉŞƣę%öäƣƋƖƠƚżƃŬƂųŗĘ»(• þģ((2)(żŵƠƙƌƚƃŬŗÆÏ(– åPŕčƝŴśŗ[m(– ď4ƄƠſŗêÍ(ĨįĀĈ• ÅÎŗĒŘJSPSÇÅăơ25880020ƣîĶĐ?Ƣŗ/sũ7łŋšŗŒŇƤ(• ÅÎŖĚņőāÿĹŋŌĹŋNTTƈƂƅƞƠųI¿wíÅÎtŗÄ`ÅÎ@ƣëÅÎ@ƣ·ÅÎ@ŖrĀņŝŇƤĨİSSL/TLS(ŗ(¶• SSL/TLS(Œ90ńŧŋ(Web(čŖĚņőŘ!ĘĖüŖùćńŧŋĦCommonName((URL(ŗ(FQDN(œç)(ŗ(¶ľ8äŒĸŦľƣFQDN(ŗx~ŖŘ1%(– DN:Hunter(ÿ((ACM(IMC(2012)(Œŗ%Ú(••••

CN(=(FQDN(:(18%(ƞŭƛƆűƠƆü:(19%(ŝŎŋŁºŕŦü(?):(40%(ü­ņ:(23%(ĩħ)j9œƄƠſ9ŗ%ĝERGWER

CR(ERFlow÷«ƄƠſ((ƄƠſ9)

Û:((}u§)

DNS(ƜžƛƉ(DNS(()j9)

ĩĩ

3´½Ŗųůƚũõ«ŒĿŕĹŵƠż• ƎƙŮŹŗ(DNS(ŲƕƂźƖäŢƗƠŹůƟ
ƆŗƛƠſŖYðńŧŋ(DNS(ŲƕƂźƖŸƠƉŖţťƣõ«G¬Œ(DNS(ųůƚľõ«ŒĿŕĹ(• ÊŖIP(ūƆƜżÁvōŗŵƠżľĸŦ(• ÐŗIPūƆƜż#,főŢĊ4ĩĪ