Accurate DNS server fingerprinting based on borderline behavior analysis

Recent security incidents against the global DNS ecosystem show a close association with outdated versions of DNS servers. Attackers and security researchers widely employ server fingerprinting as a pre-exploit technique. Considering that a single active or passive fingerprinting technique is difficult to achieve accurate and effective results, we proposed a fingerprinting method combining active and passive techniques to identify different DNS servers. We record DNS server fingerprints by collecting interaction borderline behavior of different DNS servers. After that, we propose a novel hierarchical fingerprinting model named as fpdns-ng algorithm. We apply machine learning models like Decision Tree, KNN and Multilayer Perceptron to classify different kinds of DNS servers. Experiment results prove the effectiveness of our method and show that our approach is more accurate than the state-of-the-art in fingerprinting mainstream DNS servers.