RIPE NCC DNS Measurements Hackathon

SIDN Labs' Giovane Moura, Moritz Müller and Jan Harm Kuipers were part of a team that earned an honorable mention by the jury of the RIPE NCC DNS Measurements Hackathon for their work on anomaly detection on authoritative DNS server traffic.

RIPE NCC organized a DNS measurement hackathon on April 20-21 in Amsterdam, an event that brought together topnotch engineers, researchers, designers, among others, to take up an internet measurement challenge and develop prototypes that benefit from the RIPE Atlas measurement network.

We, Giovane, Moritz and Jan Harm, together with colleagues from the University of Twente, Delft University of Technology, and VivaCell, formed the Schnabeltier/Anomalizers team. Our main goal was to develop a tool to detect anomalies on the Root DNS system, ccTLDs, and other DNS providers based on the RIPE Atlas measurements.

Team Schnabeltier (from left to right): Giovane Moura (SIDN Labs), Jan Harm Kuipers (SIDN Lab and University of Twente), Ricardo de Oliveira Schmidt (University of Twente), Christian Dörr (Delft University of Technology), Ella Titova (VivaCell) and Wouter de Vries (University of Twente).

Team Schnabeltier (from left to right): Giovane Moura (SIDN Labs), Jan Harm Kuipers (SIDN Labs and University of Twente), Ricardo de Oliveira Schmidt (University of Twente), Christian Dörr (Delft University of Technology), Ella Titova (VivaCell) and Wouter de Vries (University of Twente). Not in the picture: Moritz Müller (SIDN Labs).

Building on the results and experience from our ACM IM2016 paper on the DDoS attacks on the Root DNS system, we used RIPE’s K-Root measurement datasets to evaluate the performance of three algorithms for anomaly detection on the reachability and performance of K-Root. We also showed how network paths and anycast catchments of RIPE Atlas probes change during DDoS attacks. Anomalies in these metrics can also indicate incidents on the Internet BGP hijacking.

The software that we developed during the hackathon to automate the download, analysis, and visualization of DNS measurement is publicly available on Github. We invite the readers of this blog to follow our presentation and check out our demo.

Action picture hacketon

Overall, we look back on a great event that provided us with the opportunity to develop a tool that can be used not only at SIDN, but also any cc/gTLD service provider that is monitored by the RIPE Atlas platform. The hackathon was also  a great chance to network and to learn from other inspiring hackathon projects. Thanks to RIPE NCC and the sponsors for organizing this awesome event. We’ll definitely be back next year!