DNS Profiler: Quantifying User Browsing Risk from DNS Traffic Patterns

User profiling based on browsing behavior has traditionally been applied to improve web personalization and marketing strategies. However, leveraging browsing patterns to assess cybersecurity risks remains underexplored. In this paper, we propose a profiling framework based on domain name system (DNS) traffic analysis. Our approach models user browsing behavior using two main factors: browsing intent and domain reputation. By aggregating risk weights derived from accessed domains, we compute a personalized browsing risk score that reflects the user's exposure to online threats. We validate the effectiveness of our framework through experiments that demonstrate its ability to differentiate users with varying levels of browsing risk. Our findings offer new insights into user-centric cybersecurity assessment using minimal yet meaningful data sources.