DOI

Over the years cybercriminals have misused the Domain Name System (DNS) - a critical component of the Internet - to gain profit. Despite this persisting trend, little empirical information about the security of Top-Level Domains (TLDs) and of the overall 'health' of the DNS ecosystem exists. In this paper, we present security metrics for this ecosystem and measure the operational values of such metrics using three representative phishing and malware datasets. We benchmark entire TLDs against the rest of the market. We explicitly distinguish these metrics from the idea of measuring security performance, because the measured values are driven by multiple factors, not just by the performance of the particular market player. We consider two types of security metrics: occurrence of abuse and persistence of abuse. In conjunction, they provide a good understanding of the overall health of a TLD. We demonstrate that attackers abuse a variety of free services with good reputation, affecting not only the reputation of those services, but of entire TLDs. We find that, when normalized by size, old TLDs like.com host more bad content than new generic TLDs. We propose a statistical regression model to analyze how the different properties of TLD intermediaries relate to abuse counts. We find that next to TLD size, abuse is positively associated with domain pricing (i.e. registries who provide free domain registrations witness more abuse). Last but not least, we observe a negative relation between the DNSSEC deployment rate and the count of phishing domains.

Original languageEnglish
Title of host publicationProceedings of 2nd IEEE European Symposium on Security and Privacy (EuroS&P) 2017
PublisherInstitute of Electrical and Electronics Engineers Inc.
Pages579-594
Number of pages16
ISBN (Electronic)9781509057610
DOIs
Publication statusPublished - 28 Jun 2017
Event2nd IEEE European Symposium on Security and Privacy 2017 - Paris, France
Duration: 26 Apr 201728 Apr 2017

Conference

Conference2nd IEEE European Symposium on Security and Privacy 2017
Abbreviated titleEuroS&P 2017
CountryFrance
CityParis
Period26/04/1728/04/17

    Research areas

  • domain abuse, malware, phishing, reputation metrics, security, top-level domains

ID: 28435935