Enrichment Metadata from DNS over HTTPS Traffic

Classify encrypted traffic by separating WEB and DNS queries over the HTTPS session (port 443), moreover extract as much information as possible. E.g: GET/POST method. Therefore, our research suggests improving the end-user security, by trying to filter the malicious domain that queried from the Internet Service Provider server using Machine Learning .

Table of Contents

• About the Project
  • Background
• Getting Started
  • Prerequisites
  • Installation
• Usage
• Contact
• Acknowledgements

About The Project

Background

Getting Started

This project is based on Linux.

• In order to run the experiment on Windows, You will need to install WSL (Windows Subsystem Linux).

Prerequisites

Our code was built to run on Linux & Windows. To build the DNS response time measurement tool, You will need to install the following dependencies:

libgetdns10
libgetdns-dev
libcurl4-openssl-dev
libssl-dev
libev4, libev-dev
libevent-2.1-7, libevent-core-2.1-7, libevent-openssl-2.1-7, libevent-dev
libuv1

To measure page loads, parse the resulting HARs, and insert the HARs into a PostgreSQL database, you will need to install the following dependencies:

python3, python3-pip, python3-dev
postgresql, postgresql-client
dnsutils
net-tools
autoconf
automake
build-essential
libtool
default-jdk

In addition, you will need to install the pip packages listed in dependencies/requirements.txt with the following command:

pip3 install -r requirements.txt

For your convenience, you can install all the dependencies mentioned above by running setup.sh in dependencies with the following command:

bash setup.sh

Lastly, you will need to install the following dependency with the following command:

pip3 install --force-reinstall git+https://github.com/URenko/aioh2.git

Installation

Once you've installed the dependencies listed above, you need to do a few more things before you can start some measurements:

• Create a PostgreSQL database and user that has write access to the database

• Modify the src/code/database/postgres.ini file to contain your PostgreSQL credentials. For the har_table field, choose the name of the table that you want to store HARs for page load times. For the dns_table field, choose the name of the table that you want to store DNS response times.

• Run the following script to initialize the tables in your database that will store HARs and DNS response times:

python3 database.py postgres.ini

• Run make in src/code/dns-timing to create the DNS response time measurement tool

Usage

Usage

Contact

Project Link: https://github.com/Justrygh/Final-Project

Acknowledgements

• https://github.com/noise-lab/dns-measurement-suite