The Domain Abuse Activity Reporting System(DAAR)

Dr. Samaneh Tajalizladehkhoob

January 2019

TheDomain
AbuseActivity
ReportingSystem

What is the Domain Abuse Activity
Reporting system?
A system for reporting on domain nameregistration and abuse data across TLD
registries and registrars|2

The Domain Abuse Activity
Reporting System

How does DAAR differ from other reporting systems?
•Studies all gTLD registries and registrars for which
we can collect zone and registration data•

Employs a large set of abuse feeds (e.g., blocklists)•Accommodates historical studies•

Studies multiple threats: phishing, botnet, malware,and spam•Takes a scientific approach: transparent, reproducible|3

Project Goals
DAAR data can be used to§Report on threat activity at TLD or registrar level§

Study historical security threats or domain registration activity§

Help operators understand or consider how to manage their reputations,
their anti-abuse programs, or terms of service§

Study malicious registration behaviors§

Assist operational security communities

The purpose of DAAR is to provide data to support
community, academic, or sponsored research and analysis
for informed policy consideration

|4

DAAR
Methodology& Domain
Data

|5

DAAR Uses TLD Zone Data
DAAR system uses data from public, open, and commercial sourcesI.

DNS zone data

II.

WHOIS data

III.

Open source or commercial abuse threat (RBL) data**Certain data feeds require a license or subscription|6

i. DNS Zone
Data•

gTLD zones for gTLD domain and registry
analytics• Uses publicly available methods to collectzone data such as Centralized Zone Data
Service, zone transfer•

Uses domain names that appear in zone files•

Collect zone files from• Approximately 1220 gTLDs• Approximately 192 million domains|7ii. WHOIS§

DAAR uses published registration data(WHOIS)§ Uses registrar name and IANA ID§

Reliable, accurate registrar reporting
depends on WHOIS§ Scaling data collection from WHOIS
is a big challenge|8iii) Abuse
Threat Data

DAAR uses multiple abuse Reputation Blocklist(RBL) datasets to• Generate daily counts of domains associatedwith phishing,malware hosting, botnet C&C, and spam• Calculate daily total and cumulative abusedomains• Calculate monthly/yearly newly addedabuse domains• Create visual analytics regarding abusetrends in gTDLs|9

DAAR counts “unique” abuse domains• A domain that appears on any abusedatasets reporting to DAAR is included in thecounts once•iii) Abuse
Threat Data•

DAAR reflects how entities external to ICANN
community see the domain ecosystem| 10

Reputation
Block Lists :IdentifyingThreats| 11

DAAR Criteria for RBL Data•

RBLs must provide threat classification that match our set of security
threats•

RBLs have positive reputations in academic literature•

RBLs have positive reputations in operational and security
communities for accuracy, clarity of process•

RBLs are broadly adopted across operational security community• Feeds are incorporated into commercial security systems• Used by network operators to protect users and devices• Used by email and messaging providers to protect users| 12OtherReputation
Block ListUses•

RBLs in Browsers•

RBLs in the Cloud and Content-ServingSystems•

RBLs in Your Social Media Tools•

RBLs in the DNS•

RBLs in commercial firewalls, UTMdevices•

RBLs in enterprise mail/messagingsystems•

RBLs and Third-Party Email ServiceProviders (ESPs)| 13

DAAR Is Not an Abuse List Service§

ICANN does not compose its own reputation blocklists§ DAAR presents a composite of the data thatexternal entities use to block threats§

DAAR collects the same abuse data that is reported to industry and Internetusers and is used by§ Commercial security systems§ Academia and industry§

Academic studies and industry use validate these datasets exhibit accuracy,global coverage, reliability and low false positive rates| 14

Does DAAR Identify All Abuse Data/Types?
§No. DAAR lists domain names associated with abuse identified by thirdparties.

§Only those names associated with generic TLDs are measured and only forspecific abuse types.

| 15

Current Reputation Datasets§

SURBL lists (domains only)§Spamhaus Domain Block List§

Anti-Phishing Working Group§

Malware Patrol (Composite list)§

Phishtank§Ransomware Tracker§

Feodotracker| 16

RBLs in Academia: aMethod to Assert RBL
Confidence
Partial list of academic studies and citations ofRBLs that report to DAAR••••••••••

Rotten Apples or Bad Harvest? What We Are Measuring When We AreMeasuring Abuse
Reputation Metrics Design to Improve Intermediary Incentives for Securityof TLDs
Empirically Characterizing Domain Abuse and the Revenue Impact ofBlacklisting
Blacklist Ecosystem Analysis: Spanning Jan 2012 to Jun 2014
Taster's Choice: A Comparative Analysis of Spam Feeds
Learning to Detect Malicious URLs
Understanding the Domain Registration Behavior of Spammers
The Statistical Analysis of DNS Abuse in gTLDs (SADAG) Report
Shades of grey: On the effectiveness of reputation-based blacklists
Click Trajectories: End-to-End Analysis of the Spam Value Chain| 17Why IsDAAR
ReportingSpamDomains?

•The ICANN Governmental Advisory Committee (GAC) expressedinterest in spam domains as a security threat in its Hyderabad
correspondence to the ICANN Board of Directors… Why?
Because•Most spam are sent via illegal or duplicitous means (e.g., viabotnets).

•Spam is no longer singularly associated with email• Link spam, spamdexing, tweet spam, messaging spam(text/SMS)•Spam is a major means of delivery for other security threats• Spam has evolved to a (cloud) service: Avalanche, forexample, provided domain registrations to customers•

DAAR mainly measures domain names found in the bodies ofspam messages•

MOST IMPORTANTLY, spam domain reputation influences how
extensively or aggressively security or email administrators
apply filtering| 18

ProjectStatus| 19

Project Status
The SSR team§

Reviewed all the reviews and comments received§

Published SSR responses to DAAR comments on February 1st, 2019| 20

Project Status
The SSR team§

Published the first series of the monthly reports
On Monday 4 February 2019 ICANN published the first monthly
report from the DAAR system for January 2019.
§ The reports contain aggregated and anonymous descriptive
statistics and trend analysis on abuse concentrations in gTLDs.
§ Monthly reports from previous months (January 2018 through Dec2018) will be published before the end of February 2019 as well.
§§

The data has already enabled constructive and data driven discussions
with industry members\| 21

DAAR & the Open Data Program§

Open Data Program aims to facilitate access to data that ICANN organizationor community creates or curates§

In cases where licensing permits, DAAR data or reports will be published andincluded in the Open Data Program| 22

Project Next Steps§

Investigating publication of data into the Open Data Program§

Improving the system based on comments and reviews§

Further developing new metrics and analytics based on current andfuture research based on DAAR\| 23

Project Next Steps§

Having discussions with registries who are interested in viewing theirown data§

The SSR team does this in the context of sharing and learning fromother security professionals in the industry\| 24

VisualizingDAARData| 25

Overall Abuse Distribution in DAAR Data ( Jan. 2019)26| 26

Distribution of Abused Domains in gTLDs

27

| 27

Distribution of Domains with Different Abuse Types in gTLDs

28

| 28

Average Abuse Percentage per gTLD Across All Abuse Types

29

| 29

Where doWe Wantto Go fromHere?

| 30

Measuring Abuse§

We are always open to discussion on improvements or other ways thedata can be used to help inform discussions around DNS abuse§

Feel free to use daar@icann.org to contact us\| 31Discussions on DNS Abuse at IDS (May 10-11)\12-13 May 2019https://www.icann.org/ids| 32

Questions?
Thank You@icann
facebook.com/icannorg
youtube.com/icannnews
flickr.com/icann
linkedin/company/icann

Contact Info:
DAAR@icann.org
Samaneh.tajali@icann.org
John.crain@icann.org

slideshare/icannpresentations
soundcloud/icann| 33