Utilizing service tagging for encrypted flow classification

1. A method, comprising:

receiving, at a device in a network, domain name system (DNS) information for a domain, wherein the DNS information includes one or more service tags indicative of one or more services offered by the domain;

populating, by the device, a database of DNS information regarding a plurality of domains based in part on the received DNS information for the domain, the database of DNS information including the one or more service tags in the received DNS information;

training, by the device, a machine learning-based traffic flow classifier to distinguish domain services based on a plurality of observed traffic flows and service information stored in the database regarding the plurality of observed traffic flows;

detecting, by the device, an encrypted traffic flow associated with the domain;

identifying, by the device, a service of the one or more services as associated with the encrypted traffic flow based on a lookup in the database of DNS information and by applying the machine learning-based traffic flow classifier to the encrypted traffic flow to identify the service from among the one or more services offered by the domain; and

prioritizing, by the device, the encrypted traffic flow based on the identified service of the one or more services associated with the encrypted traffic flow.

2. The method as in claim 1 , further comprising:

sending, by the device, a DNS request for the DNS information, wherein the DNS request includes a request for the one or more service tags indicative of the one or more services offered by the domain.

3. The method as in claim 2 , wherein the request for the one or more service tags is included in an extension mechanism for DNS (EDNS) field of the DNS request.

4. The method as in claim 1 , wherein the DNS information is received via a DNS response that includes the one or more service tags in an extension mechanism for DNS (EDNS) field.

5. The method as in claim 1 , wherein the received DNS information further comprises a reputation score associated with the domain, and wherein the encrypted traffic flow is prioritized based further in part on the reputation score associated with the domain.

6. The method as in claim 1 , wherein the device is located in an access network.

7. An apparatus, comprising:

one or more network interfaces to communicate with a network;

a processor coupled to the network interfaces and configured to execute one or more processes; and

a memory configured to store a process executable by the processor, the process when executed operable to:

receive domain name system (DNS) information for a domain, wherein the DNS information includes one or more service tags indicative of one or more services offered by the domain;

populate a database of DNS information regarding a plurality of domains based in part on the received DNS information for the domain, the database of DNS information including the one or more service tags in the received DNS information;

training, by the device, a machine learning-based traffic flow classifier to distinguish domain services based on a plurality of observed traffic flows and service information stored in the database regarding the plurality of observed traffic flows;

detect an encrypted traffic flow associated with the domain;

identify a service of the one or more services as associated with the encrypted traffic flow based on a lookup in the database of DNS information and by applying the machine learning-based traffic flow classifier to the encrypted traffic flow to identify the service from among the one or more services offered by the domain; and

prioritize the encrypted traffic flow based on the identified service of the one or more services associated with the encrypted traffic flow.

8. The apparatus as in claim 7 , wherein the process when executed is further operable to:

send a DNS request for the DNS information, wherein the DNS request includes a request for the one or more service tags indicative of the one or more services offered by the domain.

9. The apparatus as in claim 8 , wherein the request for the one or more service tags is included in an extension mechanism for DNS (EDNS) field of the DNS request.

10. The apparatus as in claim 7 , wherein the DNS information is received via a DNS response that includes the one or more service tags in an extension mechanism for DNS (EDNS) field.

11. The apparatus as in claim 7 , wherein the received DNS information further comprises a reputation score associated with the domain, and wherein the encrypted traffic flow is prioritized based further in part on the reputation score associated with the domain.

12. The apparatus as in claim 7 , wherein the device is located in an access network.

13. A tangible, non-transitory, computer-readable medium storing program instructions that cause a device in a network to execute a process comprising:

receiving, at the device, domain name system (DNS) information for a domain, wherein the DNS information includes one or more service tags indicative of one or more services offered by the domain;

populating, by the device, a database of DNS information regarding a plurality of domains based in part on the received DNS information for the domain, the database of DNS information including the one or more service tags in the received DNS information;

training, by the device, a machine learning-based traffic flow classifier to distinguish domain services based on a plurality of observed traffic flows and service information stored in the database regarding the plurality of observed traffic flows;

detecting, by the device, an encrypted traffic flow associated with the domain;

identifying, by the device, a service of the one or more services as associated with the encrypted traffic flow based on a lookup in the database of DNS information and by applying the machine learning-based traffic flow classifier to the encrypted traffic flow to identify the service from among the one or more services offered by the domain; and

prioritizing, by the device, the encrypted traffic flow based on the identified service of the one or more services associated with the encrypted traffic flow.

14. The tangible, non-transitory, computer-readable medium as in claim 13 , wherein the process further comprises:

altering, by the device, the received DNS information by stripping the one or more service tags; and

forwarding, by the device, the altered DNS information to a client device, in response to a DNS request from the client device.