Augmenting Rule-based DNS Censorship Detection at Scale with Machine Learning
The proliferation of global censorship has led to the development of a plethora of measurement platforms to monitor and expose it. Censorship of the domain name system (DNS) is a key mechanism used across different countries. It is currently detected by applying heuristics to samples of DNS queries...
Enregistré dans:
| Auteurs principaux: | , , , , , , , |
|---|---|
| Format: | Article |
| Publié: |
2023
|
| Sujets: | |
| Accès en ligne: | https://arxiv.org/abs/2302.02031 http://arxiv.org/abs/2302.02031 |
| Tags: |
Pas de tags, Soyez le premier à ajouter un tag!
|
| _version_ | 1879174685156966400 |
|---|---|
| author | Brown, Jacob Jiang, Xi Tran, Van Bhagoji, Arjun Nitin Hoang, Nguyen Phong Feamster, Nick Mittal, Prateek Yegneswaran, Vinod |
| author_browse | Bhagoji, Arjun Nitin Brown, Jacob Feamster, Nick Hoang, Nguyen Phong Jiang, Xi Mittal, Prateek Tran, Van Yegneswaran, Vinod |
| author_facet | Brown, Jacob Jiang, Xi Tran, Van Bhagoji, Arjun Nitin Hoang, Nguyen Phong Feamster, Nick Mittal, Prateek Yegneswaran, Vinod |
| author_sort | Brown, Jacob |
| building | arXiv |
| collection | Acceso abierto |
| description | The proliferation of global censorship has led to the development of a plethora of measurement platforms to monitor and expose it. Censorship of the domain name system (DNS) is a key mechanism used across different countries. It is currently detected by applying heuristics to samples of DNS queries and responses (probes) for specific destinations. These heuristics, however, are both platform-specific and have been found to be brittle when censors change their blocking behavior, necessitating a more reliable automated process for detecting censorship.
In this paper, we explore how machine learning (ML) models can (1) help streamline the detection process, (2) improve the potential of using large-scale datasets for censorship detection, and (3) discover new censorship instances and blocking signatures missed by existing heuristic methods. Our study shows that supervised models, trained using expert-derived labels on instances of known anomalies and possible censorship, can learn the detection heuristics employed by different measurement platforms. More crucially, we find that unsupervised models, trained solely on uncensored instances, can identify new instances and variations of censorship missed by existing heuristics. Moreover, both methods demonstrate the capability to uncover a substantial number of new DNS blocking signatures, i.e., injected fake IP addresses overlooked by existing heuristics. These results are underpinned by an important methodological finding: comparing the outputs of models trained using the same probes but with labels arising from independent processes allows us to more reliably detect cases of censorship in the absence of ground-truth labels of censorship. |
| first_indexed | 2026-10-16T00:17:03Z |
| format | Article |
| fullrecord | <oai_dc:dc xmlns:oai_dc="http://www.openarchives.org/OAI/2.0/oai_dc/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.openarchives.org/OAI/2.0/oai_dc/ https://www.openarchives.org/OAI/2.0/oai_dc.xsd"><identifier>arxiv-2302.02031</identifier><datestamp>2023-06-19</datestamp>
<dc:title>Augmenting Rule-based DNS Censorship Detection at Scale with Machine Learning</dc:title>
<dc:creator>Brown, Jacob</dc:creator>
<dc:creator>Jiang, Xi</dc:creator>
<dc:creator>Tran, Van</dc:creator>
<dc:creator>Bhagoji, Arjun Nitin</dc:creator>
<dc:creator>Hoang, Nguyen Phong</dc:creator>
<dc:creator>Feamster, Nick</dc:creator>
<dc:creator>Mittal, Prateek</dc:creator>
<dc:creator>Yegneswaran, Vinod</dc:creator>
<dc:subject>Machine Learning</dc:subject>
<dc:subject>Artificial Intelligence</dc:subject>
<dc:subject>Computers and Society</dc:subject>
<dc:subject>Networking and Internet Architecture</dc:subject>
<dc:description>The proliferation of global censorship has led to the development of a plethora of measurement platforms to monitor and expose it. Censorship of the domain name system (DNS) is a key mechanism used across different countries. It is currently detected by applying heuristics to samples of DNS queries and responses (probes) for specific destinations. These heuristics, however, are both platform-specific and have been found to be brittle when censors change their blocking behavior, necessitating a more reliable automated process for detecting censorship.
In this paper, we explore how machine learning (ML) models can (1) help streamline the detection process, (2) improve the potential of using large-scale datasets for censorship detection, and (3) discover new censorship instances and blocking signatures missed by existing heuristic methods. Our study shows that supervised models, trained using expert-derived labels on instances of known anomalies and possible censorship, can learn the detection heuristics employed by different measurement platforms. More crucially, we find that unsupervised models, trained solely on uncensored instances, can identify new instances and variations of censorship missed by existing heuristics. Moreover, both methods demonstrate the capability to uncover a substantial number of new DNS blocking signatures, i.e., injected fake IP addresses overlooked by existing heuristics. These results are underpinned by an important methodological finding: comparing the outputs of models trained using the same probes but with labels arising from independent processes allows us to more reliably detect cases of censorship in the absence of ground-truth labels of censorship. </dc:description>
<dc:description>To appear in Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD '23)</dc:description>
<dc:date>2023-02-03</dc:date>
<dc:date>2023-06-15</dc:date>
<dc:type>text</dc:type>
<dc:identifier>https://arxiv.org/abs/2302.02031</dc:identifier>
<dc:identifier>http://arxiv.org/abs/2302.02031</dc:identifier>
</oai_dc:dc> |
| id | arxiv-2302.02031 |
| institution | arXiv |
| last_indexed | 2026-10-16T00:17:03Z |
| publishDate | 2023 |
| publishDateRange | 2023 |
| publishDateSort | 2023 |
| record_format | oai_dc |
| spelling | arxiv-2302.020312023-06-19 Augmenting Rule-based DNS Censorship Detection at Scale with Machine Learning Brown, Jacob Jiang, Xi Tran, Van Bhagoji, Arjun Nitin Hoang, Nguyen Phong Feamster, Nick Mittal, Prateek Yegneswaran, Vinod Machine Learning Artificial Intelligence Computers and Society Networking and Internet Architecture The proliferation of global censorship has led to the development of a plethora of measurement platforms to monitor and expose it. Censorship of the domain name system (DNS) is a key mechanism used across different countries. It is currently detected by applying heuristics to samples of DNS queries and responses (probes) for specific destinations. These heuristics, however, are both platform-specific and have been found to be brittle when censors change their blocking behavior, necessitating a more reliable automated process for detecting censorship. In this paper, we explore how machine learning (ML) models can (1) help streamline the detection process, (2) improve the potential of using large-scale datasets for censorship detection, and (3) discover new censorship instances and blocking signatures missed by existing heuristic methods. Our study shows that supervised models, trained using expert-derived labels on instances of known anomalies and possible censorship, can learn the detection heuristics employed by different measurement platforms. More crucially, we find that unsupervised models, trained solely on uncensored instances, can identify new instances and variations of censorship missed by existing heuristics. Moreover, both methods demonstrate the capability to uncover a substantial number of new DNS blocking signatures, i.e., injected fake IP addresses overlooked by existing heuristics. These results are underpinned by an important methodological finding: comparing the outputs of models trained using the same probes but with labels arising from independent processes allows us to more reliably detect cases of censorship in the absence of ground-truth labels of censorship. To appear in Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD '23) 2023-02-03 2023-06-15 text https://arxiv.org/abs/2302.02031 http://arxiv.org/abs/2302.02031 |
| spellingShingle | Machine Learning Artificial Intelligence Computers and Society Networking and Internet Architecture Brown, Jacob Jiang, Xi Tran, Van Bhagoji, Arjun Nitin Hoang, Nguyen Phong Feamster, Nick Mittal, Prateek Yegneswaran, Vinod Augmenting Rule-based DNS Censorship Detection at Scale with Machine Learning |
| title | Augmenting Rule-based DNS Censorship Detection at Scale with Machine Learning |
| title_full | Augmenting Rule-based DNS Censorship Detection at Scale with Machine Learning |
| title_fullStr | Augmenting Rule-based DNS Censorship Detection at Scale with Machine Learning |
| title_full_unstemmed | Augmenting Rule-based DNS Censorship Detection at Scale with Machine Learning |
| title_short | Augmenting Rule-based DNS Censorship Detection at Scale with Machine Learning |
| title_sort | augmenting rule based dns censorship detection at scale with machine learning |
| topic | Machine Learning Artificial Intelligence Computers and Society Networking and Internet Architecture |
| url | https://arxiv.org/abs/2302.02031 http://arxiv.org/abs/2302.02031 |
| work_keys_str_mv | AT brownjacob augmentingrulebaseddnscensorshipdetectionatscalewithmachinelearning AT jiangxi augmentingrulebaseddnscensorshipdetectionatscalewithmachinelearning AT tranvan augmentingrulebaseddnscensorshipdetectionatscalewithmachinelearning AT bhagojiarjunnitin augmentingrulebaseddnscensorshipdetectionatscalewithmachinelearning AT hoangnguyenphong augmentingrulebaseddnscensorshipdetectionatscalewithmachinelearning AT feamsternick augmentingrulebaseddnscensorshipdetectionatscalewithmachinelearning AT mittalprateek augmentingrulebaseddnscensorshipdetectionatscalewithmachinelearning AT yegneswaranvinod augmentingrulebaseddnscensorshipdetectionatscalewithmachinelearning |