The DOI matches its Crossref record.
On the reduction of authoritative DNS cache timeouts: Detection and implications for user privacy
Open accessAbstract
The domain name system (DNS) is an Internet network service that is used by hosts to resolve IP addresses from symbolic names. This basic service has been attacked and abused many times, as it is one of the oldest and most vulnerable services on the Internet. Some DNS resolvers conduct DNS manipulation, in which authoritative DNS responses are modified. This DNS manipulation is sometimes used for legitimate reasons (e.g., parental control) and other times is used to support malicious activities, such as DNS poisoning or data collection. Between these DNS manipulation activities, some Internet service providers (ISPs) are changing the DNS cache timeout of the DNS responses with which their DNS resolvers responded to obtain additional data about their subscribers. These data can be a detailed web browsing profile of the user. This approach does not require a large investment and can yield huge benefits if the information is used or sold. Therefore, user privacy is disputed. We conducted a study in which we analyse how ISPs use this DNS manipulation, propose a method for identifying this DNS manipulation by the end-user and determine the amount of information an ISP can collect by using it. We also developed a public web tool, for which the source code is available, that can help Internet users determine whether their privacy is being compromised by their ISP via the exploitation of DNS cache timeouts. This service can facilitate the collection of data on how many people are victims of this abuse and which ISPs around the world are utilizing this technique.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“To our knowledge, Continnum is the first system to use TTL to regulate LLM KV cache as a function of predicted toolcall durations, scheduling-side delay propagation, and workload pattern.”
From Continuum: Efficient and Robust Multi-Turn LLM Agent Scheduling with KV Cache Time-to-Live (2025) · cites this paper as [22]
Citations
Cites
No references could be resolved yet.
Research works printed but not linked: 15
- Callahan, 2013, On modern DNS behavior and properties, Comput. Commun. Rev., 43, 7, 10.1145/2500098.2500100 · DOI
- Drako, 2013, Policy-managed DNS server for to control network traffic, U.S. Patent No., 8, 447
- García-Dorado, 2018, DNS weighted footprints for web browsing analytics, J. Netw. Comput. Appl., 35, 10.1016/j.jnca.2018.03.008 · DOI
- Hernan, 2006, Threat modeling: uncover security design flaws using the STRIDE approach, MSDN Mag., 6, 68
- Herrmann, 2013, Behavior-based tracking: exploiting characteristic patterns in DNS traffic, Comput. Secur., 39, 17, 10.1016/j.cose.2013.03.012 · DOI
- Jung, 2002, DNS performance and the effectiveness of caching, IEEE/ACM Trans. Netw., 10, 589, 10.1109/TNET.2002.803905 · DOI
- Kim, 2015, vol. 164, 348
- Liu, 2018, Who is answering my queries: understanding and characterizing interception of the DNS resolution path”, Proceedings of the Applied Networking Research Workshop, 15
- Ma, 2015, Accurate DNS query characteristics estimation via active probing, J. Netw. Comput. Appl., 47, 72, 10.1016/j.jnca.2014.09.016 · DOI
- Moreno, 2015, Commodity packet capture engines: tutorial, cookbook and applicability, IEEE Communications Surveys & Tutorials, 17, 1364, 10.1109/COMST.2015.2424887 · DOI
- Rajab, 2008, “Peeking through the cloud: DNS-based estimation and its applications”, applied Cryptography and network security, Lect. Notes Comput. Sci., 5037, 10.1007/978-3-540-68914-0_2 · DOI
- Szalachowski, 2017, Short paper: on deployment of DNS-based security enhancements, Financial Cryptography and Data Security. Lecture Notes in Computer Science, 10322, 10.1007/978-3-319-70972-7_24 · DOI
- Torres, 2017, Time-based density clustering to enable free browsing of sites in pay-per-use mobile internet providers”, J. Netw. Comput. Appl., 99, 17, 10.1016/j.jnca.2017.10.007 · DOI
- Vavrusa, 2018, Managing domain name system (DNS) queries using a proxy DNS server, U.S. Patent Application, 10/033, 692
- Yan, 2020, The road to DNS privacy”, Future Generat. Comput. Syst., 112, 604, 10.1016/j.future.2020.06.012 · DOI
Cited by
Sorted by citations
Continuum: Efficient and Robust Multi-Turn LLM Agent Scheduling with KV Cache Time-to-Live
Li, H., He, R., Mang, Q., Zhang, Q., Mao, H., Chen, X., Zhou, H., Zhang, H., Cheung, A., Gonzalez, J., et al. (2025) · arXiv · doi:10.48550/arxiv.2511.02230
“…in Computer Systems: Time-to-live (TTL) is a longstanding abstraction in computer systems de-sign, widely used in DNS resolvers, distributed caches, CDN edge nodes, and consistency protocols to bound staleness and prevent unbounded resource retention [11, 15, 21, 22, 25, 27, 32, 42, 43, 58].”
Metadata
- Authors
- Hernandez-Quintanilla, T., Magaña, E., Morató, D., & Izal, M.
- Affiliations
- Universidad Pública de Navarra (UPNA) (ES)
- Corresponding author
- Magaña, Eduardo
- Venue
- Journal of Network and Computer Applications
- Publisher
- Elsevier BV
- Published
- 2021-02
- Volume
- 176
- Pages
- 102941
- ISSN
- 1084-8045 (ISSN-L)
- OpenAlex
- W3107582994
- Cited by
- 8
- References
- 0
- Citations by year
- 2026: 2 · 2025: 2 · 2024: 1 · 2022: 2 · 2021: 1
- FWCI
- 1.00
- Type
- journal article
- Language
- en
- Open access
- hybrid
- doi.org
- Licence
- Locations
- Journal of Network and Computer Applications (publishedVersion, cc-by)
- Academica-e (Universidad Pública de Navarra) (submittedVersion, cc-by)
- Funders
- Agencia Estatal de Investigación (PID2019-104451RB-C22/AEI/10.13039/501100011033)
- Topics
- Social Sciences › Sociology and Political Science › Privacy, Security, and Data Protection
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Keywords
- user privacy, DNS resolvers
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
