Projects per year
Over the years cybercriminals have misused the Domain Name System (DNS) - a critical component of the Internet - to gain profit. Despite this persisting trend, little empirical information about the security of Top-Level Domains (TLDs) and of the overall 'health' of the DNS ecosystem exists. In this paper, we present security metrics for this ecosystem and measure the operational values of such metrics using three representative phishing and malware datasets. We benchmark entire TLDs against the rest of the market. We explicitly distinguish these metrics from the idea of measuring security performance, because the measured values are driven by multiple factors, not just by the performance of the particular market player. We consider two types of security metrics: occurrence of abuse and persistence of abuse. In conjunction, they provide a good understanding of the overall health of a TLD. We demonstrate that attackers abuse a variety of free services with good reputation, affecting not only the reputation of those services, but of entire TLDs. We find that, when normalized by size, old TLDs like.com host more bad content than new generic TLDs. We propose a statistical regression model to analyze how the different properties of TLD intermediaries relate to abuse counts. We find that next to TLD size, abuse is positively associated with domain pricing (i.e. registries who provide free domain registrations witness more abuse). Last but not least, we observe a negative relation between the DNSSEC deployment rate and the count of phishing domains.
|Title of host publication||Proceedings of 2nd IEEE European Symposium on Security and Privacy (EuroS&P) 2017|
|Publisher||Institute of Electrical and Electronics Engineers (IEEE)|
|Number of pages||16|
|Publication status||Published - 2017|
|Event||2nd IEEE European Symposium on Security and Privacy 2017 - Paris, France|
Duration: 26 Apr 2017 → 28 Apr 2017
|Conference||2nd IEEE European Symposium on Security and Privacy 2017|
|Abbreviated title||EuroS&P 2017|
|Period||26/04/17 → 28/04/17|
- domain abuse
- reputation metrics
- top-level domains
FingerprintDive into the research topics of 'Reputation Metrics Design to Improve Intermediary Incentives for Security of TLDs'. Together they form a unique fingerprint.
- 1 Active
van Eeten, M. J. G., Hernandez Ganan, C., Gürses, F. S., van Wegberg, R. S., Parkin, S. E., Zhauniarovich, Y., van Engelenburg, S. H., Kadenko, N. I., Labunets, K., Akyazi, U., Bouwman, X. B., Jansen, B. A., Kaur, M., Al Alsadi, A., Lone, Q. B., Turcios Rodriguez, E. R., Vermeer, M., van Harten, V. T. C., Vetrivel, S., Oomens, E. C., Kustosch, L. F., Bisogni, F., Ciere, M., Fiebig, T., Korczynski, M. T., Moreira Moura, G. C., Noroozian, A., Pieters, W., Tajalizadehkhoob, S., Dacier, B. H. A., San José Sanchez, J. & Çetin, F. O.
1/01/10 → …