Strengthening Domain Name Abuse Remediation : Domain Classification and Blocklist Enhancement
Jan Bayer · 2023
Renforcement des moyens de lutte contre l'abus des noms de domaines : classification des domaines et amélioration des listes de blocage The Domain Name System (DNS) plays a pivotal role in the architecture of the Internet, translating human-readable domain names into machine-readable IP addresses. However, with the continuous expansion of the Internet, it has become increasingly susceptible to domain name abuse, encompassing a wide range of malicious activities that exploit the DNS infrastructure. This doctoral thesis embarks on a comprehensive exploration of domain name abuse, offering contributions in three key areas.First, this research evaluates the extent and scale of domain name abuse. We conducted active measurements on 251 million existing domain names and employed data from well-known blocklists to provide reputation metrics for Top-Level Domains (TLDs), registrars, and hosting providers along with the analysis of mitigation times in response to abuse incidents.Second, this thesis addresses the need for a practical and operational domain name classifier to distinguish between maliciously registered and compromised domains used in phishing that can be readily employed by intermediaries in real-world scenarios. We propose novel approaches that overcome the shortcomings of some existing systems. Two primary contributions are an automated method for building the ground truth dataset and the resilience to missing data values, a common challenge when dealing with public resources and active measurements. This resilience ensures the reliability and utility of the classifier in diverse operational contexts.Last, we create a whitelist of domains. This whitelist is meticulously curated to encompass domains that exhibit characteristics suggesting a low likelihood of engaging in phishing activities. Whitelisted domains are extracted from four publicly available sources – DNS records, domain registration information, domain certificates, and reports published by approved dispute resolution service providers. The introduction of a whitelist component aims to enhance the accuracy of existing blocklists, promoting a more nuanced and comprehensive approach to mitigating domain name abuse.The culmination of these contributions seeks to help for a better understanding of domain name abuse, its prevalence, and effective mitigation strategies. Moreover, the practical tools and resources developed in this research promise to empower Internet intermediaries in their ongoing efforts to safeguard the integrity and security of the global DNS ecosystem.