Reputation Metrics Design to Improve Intermediary Incentives for Security of TLDs

Maciej Korczynski, Samaneh Tajalizadehkhoob, Arman Noroozian, Maarten Wullink, Cristian Hesselman, Michel Van Eeten

Research output: Chapter in Book/Conference proceedings/Edited volumeConference contributionScientificpeer-review

15 Citations (Scopus)


Over the years cybercriminals have misused the Domain Name System (DNS) - a critical component of the Internet - to gain profit. Despite this persisting trend, little empirical information about the security of Top-Level Domains (TLDs) and of the overall 'health' of the DNS ecosystem exists. In this paper, we present security metrics for this ecosystem and measure the operational values of such metrics using three representative phishing and malware datasets. We benchmark entire TLDs against the rest of the market. We explicitly distinguish these metrics from the idea of measuring security performance, because the measured values are driven by multiple factors, not just by the performance of the particular market player. We consider two types of security metrics: occurrence of abuse and persistence of abuse. In conjunction, they provide a good understanding of the overall health of a TLD. We demonstrate that attackers abuse a variety of free services with good reputation, affecting not only the reputation of those services, but of entire TLDs. We find that, when normalized by size, old TLDs host more bad content than new generic TLDs. We propose a statistical regression model to analyze how the different properties of TLD intermediaries relate to abuse counts. We find that next to TLD size, abuse is positively associated with domain pricing (i.e. registries who provide free domain registrations witness more abuse). Last but not least, we observe a negative relation between the DNSSEC deployment rate and the count of phishing domains.

Original languageEnglish
Title of host publicationProceedings of 2nd IEEE European Symposium on Security and Privacy (EuroS&P) 2017
PublisherInstitute of Electrical and Electronics Engineers (IEEE)
Number of pages16
ISBN (Electronic)9781509057610
Publication statusPublished - 2017
Event2nd IEEE European Symposium on Security and Privacy 2017 - Paris, France
Duration: 26 Apr 201728 Apr 2017


Conference2nd IEEE European Symposium on Security and Privacy 2017
Abbreviated titleEuroS&P 2017


  • domain abuse
  • malware
  • phishing
  • reputation metrics
  • security
  • top-level domains


Dive into the research topics of 'Reputation Metrics Design to Improve Intermediary Incentives for Security of TLDs'. Together they form a unique fingerprint.

Cite this