Search

TheDomain Name System(DNS) plays a crucial role in connecting services and users on the Internet. Since its first specification, DNS has been extended in numerous documents to keep it fit for today’s challenges and demands. And these challenges are many. Revelations of snooping on DNS traffic led to changes to guarantee confidentiality of DNS queries. Attacks to forge DNS traffic led to changes to shore up the integrity of the DNS. Finally, denial-of-service attack on DNS operations have led to new DNSoperations architectures. All of these developments make DNS a highly interesting, but also highly challenging research topic. This tutorial – aimed at graduate students and early-career researchers – provides a overview of the modern DNS, its ongoing development and its open challenges. This tutorial has four major contributions. We first provide a comprehensive overview of the DNS protocol. Then, we explain how DNS is deployed in practice. This lays the foundation for the third contribution: a review of the biggest challenges the modern DNS faces today and how they can be addressed. These challenges are (i) protecting the confidentiality and (ii) guaranteeing the integrity of the information provided in the DNS, (iii) ensuring the availability of the DNS infrastructure, and (iv) detecting and preventing attacks that make use of the DNS. Last, we discuss which challenges remain open, pointing the reader towards new research areas.

Concern has been mounting about Internet centralization over the few last years -- consolidation of traffic/users/infrastructure into the hands of a few market players. We measure DNS and computing centralization by analyzing DNS traffic collected at a DNS root server and two country-code top-level domains (ccTLDs) -- one in Europe and the other in Oceania -- and show evidence of concentration. More than 30% of all queries to both ccTLDs are sent from 5 large cloud providers. We compare the clouds resolver infrastructure and highlight a discrepancy in behavior: some cloud providers heavily employ IPv6, DNSSEC, and DNS over TCP, while others simply use unsecured DNS over UDP over IPv4. We show one positive side to centralization: once a cloud provider deploys a security feature -- such as QNAME minimization -- it quickly benefits a large number of users.

Miscreants abuse thousands of domain names every day by launching large-scale attacks such as phishing or malware campaigns. While some domains are solely registered for malicious purposes, others are benign but get compromised and misused to serve malicious content. Existing methods for their detection can either predict malicious domains at the time of registration or identify indicators of an ongoing malicious activity conflating maliciously registered and compromised domains into common blacklists. Since the mitigation actions for these two types domains are different, we propose COMAR, an approach to differentiate between compromised and maliciously registered domains, complementary to previously proposed domain reputation systems. We start the paper with a thorough analysis of the domain life cycle to determine the relationship between each step and define its associated features. COMAR uses a set of 38 features costly to evade. We evaluate COMAR using phishing and malware blacklists and show that it can achieve high accuracy (97% accuracy with a 2.5% false-positive rate) without using any privileged or non-publicly available data, which makes it suitable for the use by any organization. We plan to deploy COMAR at two domain registry operators of the European country-code TLDs and set up an early notification system to facilitate the remediation of blacklisted domains.

Policy makers in regions such as Europe are increasingly concerned about the trustworthiness and sovereignty of the foundations of their digital economy, because it often depends on systems operated or manufactured elsewhere. To help curb this problem, we propose the novel notion of a responsible Internet, which provides higher degrees of trust and sovereignty for critical service providers (e.g., power grids) and all kinds of other users by improving the transparency, accountability, and controllability of the Internet at the network-level. A responsible Internet accomplishes this through two new distributed and decentralized systems. The first is the Network Inspection Plane (NIP), which enables users to request measurement-based descriptions of the chains of network operators (e.g., ISPs and DNS and cloud providers) that handle their data flows or could potentially handle them, including the relationships between them and the properties of these operators. The second is the Network Control Plane (NCP), which allows users to specify how they expect the Internet infrastructure to handle their data (e.g., in terms of the security attributes that they expect chains of network operators to have) based on the insights they gained from the NIP. We discuss research directions and starting points to realize a responsible Internet by combining three currently largely disjoint research areas: large-scale measurements (for the NIP), open source-based programmable networks (for the NCP), and policy making (POL) based on the NIP and driving the NCP. We believe that a responsible Internet is the next stage in the evolution of the Internet and that the concept is useful for clean slate Internet systems as well.

Distributed Denial-of-Service (DDoS) attacks continue to be a major threat in the Internet today. DDoS attacks over- whelm target services with requests or other traffic, causing requests from legitimate users to be shut out. A common defense against DDoS is to replicate the service in multiple physical locations or sites. If all sites announce a common IP address, BGP will associate users around the Internet with a nearby site, defining the catchment of that site. Anycast ad- dresses DDoS both by increasing capacity to the aggregate of many sites, and allowing each catchment to contain attack traffic leaving other sites unaffected. IP anycast is widely used for commercial CDNs and essential infrastructure such as DNS, but there is little evaluation of anycast under stress. This paper provides the first evaluation of several anycast services under stress with public data. Our subject is the Internet’s Root Domain Name Service, made up of 13 inde- pendently designed services (“letters‿, 11 with IP anycast) running at more than 500 sites. Many of these services were stressed by sustained traffic at 100× normal load on Nov. 30 and Dec. 1, 2015. We use public data for most of our anal- ysis to examine how different services respond to the these events. We see how different anycast deployments respond to stress, and identify two policies: sites may absorb attack traffic, containing the damage but reducing service to some users, or they may withdraw routes to shift both good and bad traffic to other sites. We study how these deployments policies result in different levels of service to different users. We also show evidence of collateral damage on other services located near the attacks.

Today's consumers have a wide variety of interactive media and services at their disposal, for instance, through IPTV networks, the Internet, and in-home and mobile networks. A major problem, however, is that media and services do not interoperate across networks because they use different user identities, metadata formats, and signaling protocols, for example. As a result, users cannot easily combine media and services from different network infrastructures and share them in an integrated manner with their family and friends. In addition to limiting people's media experience, this also hinders the introduction of new services and business models as providers cannot easily develop and operate cross-network services. The goal of our work is to overcome this problem by means of an open and intelligent service platform that allows applications to easily combine media and services from different network infrastructures, and enables consumers to easily share them in an integrated way. The platform includes support for managing multi-user sessions across networks, context-aware recommendations, and cross-network identity management. While there has been prior work on platforms for converged media, our platform is unique in that it provides open, intelligent, and interoperable facilities for sharing media and services across network infrastructures. In addition, our work involves several specific innovations, for instance, pertaining to cross-network session management and synchronization. In this article we discuss the platform, its most important enabling services, and some of the applications we have built on top of it. We also briefly consider the new kinds of business models our platform makes possible.

This intelligent multimedia adaptation and delivery framework tailors to ubiquitous environments, so that users can experience multimedia content using multiple devices in various mobility situations. Multidevice environments offer the potential to enhance the user experience in terms of flexibility and interactivity and will enable novel applications in education, entertainment, collaboration, and communication. We analyzed the different processing steps and defined related framework functionalities such as the generation of the presentation schedule, the computation of the presentation-environment matches, personalization through situation learning, and device(s)-tailored presentation delivery.

The current access to mobile services a user has, is defined by the user's mobile terminal as the single entry point to an operators network. This comes along with a set of limitations. Although performance and multimedia capabilities of mobile devices are constantly increasing, user-service interaction is still limited due to physical constraints imposed by the form factor. Another drawback is the varying ability of devices to download and execute new services. At the same time it is not possible to synchronise, exchange or share the user's data and media content among different devices. In order to overcome these limitations this paper presents the concept of the Distributed Communication Sphere and the according architectural framework that allows its management. This framework defines functional components to enable multi-device delivery of communication and media service sessions, user input interpretation, terminal management and resource discovery. It also provides flexible service delivery through the dynamic desktop component and relies on intelligent service enablers of the underlying service platform architecture, such as context-awareness, service provisioning and personal profile enablers. The work has been performed as part of the EU IST-SPICE (027617) project targeting intelligent extensions for next generation service platforms.