Attackers often identify DNS traffic to disrupt or compromise Internet services. While prior work has focused on encrypting queries using DNS over TLS, HTTPS, or QUIC to counter such attacks, we consider IETF protocols designed for resource-constrained IoT devices and empirically analyze the potential of obfuscating DNS traffic in addition to encryption. We create a dataset of machine-to-machine-compatible data objects along with the corresponding DNS resolution processes, evaluating 296 deployment scenarios of resolving host names, including DNS over the Constrained Application Layer Protocol (CoAP) and an onion routing flavor of CoAP under varying link-layer conditions. We compare them to DNS over HTTPS. Using Random Forest and a header field analysis, we identify fields that leak most information. Our findings show that DNS over CoAP with equalized packet lengths, block-wise transfer, and header compression reduces the accuracy of identifying DNS frames to 86% and further to 77% with payload compression. Our approach outperforms DNS over HTTPS, where classifiers always identify DNS frames based on IP addresses. The dataset is publicly available.

翻译：攻击者常通过识别DNS流量来干扰或攻陷互联网服务。虽然以往研究聚焦于通过TLS、HTTPS或QUIC上的DNS加密查询来对抗此类攻击，但我们针对为资源受限物联网设备设计的IETF协议展开研究，并通过实证分析探讨在加密基础上增加DNS流量混淆的潜力。我们创建了包含机器对机器兼容数据对象及其对应DNS解析过程的数据集，评估了296种主机名解析场景，包括受限应用层协议（CoAP）上的DNS以及一种带有洋葱路由特性的CoAP变体在不同链路层条件下的表现。我们将其与HTTPS上的DNS进行了对比。通过随机森林算法及头部字段分析，我们识别出信息泄露最多的字段。研究结果表明：采用等长数据包、分块传输及头部压缩的CoAP上的DNS可将DNS帧识别准确率降至86%，而引入载荷压缩后更降至77%。该方法优于HTTPS上的DNS——后者在分类器通过IP地址识别DNS帧时表现更差。该数据集已公开。