As a research team, our main preoccupation here at SIDN Labs is looking ahead. However, it's good to look back once in a while, and there's no better time for doing that than the end of the year. So that's what I'd like to do in this blog post… before going on to tell you what we've got planned for 2017!
A successful year!
I think it's fair to say that 2016 was a very successful year for the Labs team, because we were emphatically able to make our work even more relevant and deliver even greater added value to the (technical) internet community and SIDN.
Our success was based on tangible research products. My personal highlights were making our ENTRADA software open-source, running two collaborative security pilots, doing two research projects for ICANN, publishing our Valibox software and getting two articles published in high-level international contexts.
Open-sorcing ENTRADA
In January, we put our ENTRADA software in the public domain. ENTRADA is our big data system for quickly and easily detecting threats and abnormalities from very large volumes of DNS traffic data. We were already using the system in various ways for .nl and decided that making it open-source was the right thing to do, in the interests of the security and stability of the DNS – which is after all one of the core systems of the global internet infrastructure. Since ENTRADA went open-source, six other registries, including .ca (Canada) and .at (Austria) have started experimenting with or making operational use of our software. And the new users are now actively contributing to ENTRADA's further development. We also ran a half-day ENTRADA workshop at the most recent CENTR R&D meeting, in Prague.
Back here at the Labs, we've extended the use of ENTRADA considerably in 2016. For example, it's been used in two collaborative security pilots (see below), to empirically analyse the impact of the reducing TTL values for .nl from two hours to one, and to upgrade our statistics site. We also increased the capacity of the Hadoop cluster that ENTRADA uses and connected a further three .nl name servers. That means that DNS traffic data from four of SIDN's six unicast name servers for .nl is now piped to our ENTRADA set-up. We currently have the details of 320 billion DNS queries and responses going back to May 2014 (with all the data eighteen months old or older anonymised in accordance with our privacy framework).
Collaborative security pilots
In 2016, we made considerable progress in the field of collaborative security, thanks to two pilot projects.
The first pilot involved the New Domains Early Warning System (nDEWS), an experimental ENTRADA application that provides an automated alert whenever the DNS traffic linked to a new domain name shows a pattern suggestive of phishing in the first hours after registration. Thirty-two registrars are now signed up to receive nDEWS alerts. Our colleagues in SIDN's Registration & Service Department also use the system to help registrars that aren't involved in the pilot. Since October, the fully automated nDEWS set-up has identified dozens of phishing sites that hadn't yet been listed in the external abuse feeds that we use.
For the second pilot, we linked up with the Fraudehelpdesk to investigate the scope for combining our two organisations' data to improve the identification of phishing sites. The Fraudehelpdesk sent us details of .nl domain names that end users had reported as suspect, and an automated system here sent back details of the domain names in question. The information we shared included each suspect domain name's registration date and the number of associated DNS queries recorded in ENTRADA over the last seven days. Everything was enabled by a technical interface between ENTRADA and the Fraudehelpdesk's APATE reporting system.
Although the pilot has only been going a few weeks, the results so far look promising: with the help of our data, the Fraudehelpdesk has already been able to detect dozens of new phishing sites. The next steps will be to integrate enriched data into the Fraudehelpdesk's processes and to make the ENTRADA-APATE interface bi-directional.
Research projects for ICANN
At the start of November, along with our colleagues at NLnet Labs and TNO, we published a joint technical report setting out the results of the CDAR Project (Continuous Data-driven Analysis of Root Stability). The project looked at the impact of introducing more than 1,100 new gTLDs on the security and stability of the root DNS system. It utilised large volumes of historical data from various sources, including RIPE ATLAS (active monitoring) and RSSAC002 (passive monitoring).
Our main conclusion was that the root DNS system is capable of handling the extra DNS traffic associated with the new gTLDs. That is because the system is flexible and resilient and because the volume of DNS query traffic associated with new extensions remains very small (1.1 per cent of all legitimate DNS traffic processed by the root).
In November, ICANN selected us and TU Delft to undertake another study: a statistical analysis of the abuse of domain names in new and legacy gTLDs. So, for example, we'll be investigating how many domain names in a gTLD are used for phishing or malware. The project has been dubbed SADAG: Statistical Analysis of DNS Abuse in gTLDs. Since 2014, SIDN Labs and TU Delft have been running the closely related REMEDI3S-TLD project. In view of the significant overlap, the REMEDI3S-TLD methodology has been adopted for SADAG.
Both CDAR and SADAG were commissioned by ICANN on a commercial basis. Together with our partners, we won the research contracts at the end of a public tendering process. The projects provide input for evaluation of the New gTLD Programme on the grounds of Competition, Consumer Trust and Consumer Choice.
Open-sourcing Valibox
Our second open-source release of the year involved the Valibox software. Valibox turns an OpenWrt device into a 'validation box': a device that checks the signatures of DNSSEC domain names. We took the GLiNet mini-router and adapted it to work as a validation box, so that users can quickly and easily enable DNSSEC validation on their home networks. Our Valibox software is based on the Unbound resolver software created by NLnet Labs, which we've extended by adding a user-friendly form of Negative Trust Anchor (NTA) management.
We came up with the Valibox concept because Internet Access Providers in the Netherlands remain averse to supporting the validation of DNSSEC signatures. The lack of ISP-enabled validation means that the internet infrastructure is currently less secure than it needs to be. Our Valibox software empowers internet users to take matters into their own hands and makes it easy for appliance builders to add DNSSEC validation functionality to their own software.
Prestigious publications
During 2016, we had two articles published in high-level international contexts.
The first was 'Anycast vs. DDoS: Evaluating the November 2015 Root DNS Event', about a detailed empirical analysis of the large-scale DDoS attacks on the DNS root in November and December 2015. We submitted the article for the prestigious ACM Internet Measurements Conference (IMC2016), and it was accepted after a thorough review by anonymous experts from industry and academia. We had undertaken the research in partnership with the University of Twente and the Information Sciences Institute at the University of Southern California.
From an operational perspective, the research taught us that an attack on the DNS root can result in a spill-over to name servers operating in the same data centre. That knowledge is now incorporated into the criteria that we use for selecting sites for .nl's anycast name servers.
The second article, 'Increasing DNS Security and Stability through a Control Plane for Top-level Domain Operators', sets out our vision of the registry of the future and describes what we are doing at SIDN to realise that vision. We submitted the article to IEEE Communications Magazine, for use in the context of its Network and Service Management theme. The magazine publishes tutorial-style articles based on research by universities and enterprises, and – like the IMC – accepts material only after thorough review by anonymous experts. The article was written in collaboration with the University of Twente and is due to appear in January. The post-print version is already available to read on our site.
Finally, we also had an article published in the journal Privacy & Information about our operational experiences with our ENTRADA privacy framework and an article about ENTRADA itself.
2017
Our main focuses for the year ahead are as follows:
Further development of the TLD Control Plane concept featured in our IEEE ComMag article
Application and expansion of our expertise in the field of data analytics, e.g. for the SADAG project
Further innovation of SIDN's operational services and processes, e.g. by utilising new anti-abuse intelligence and introducing an ENTRADA-driven marketing dashboard
Consideration of IoT security and privacy as a possible new research theme on the basis of pilots with Valibox devices
Continuation of the policy of sharing results in the form of open-source software, open data and papers
All the best for 2017, everyone!
On behalf of the whole SIDN Labs team,
Cristian
