Gollector: Measuring Domain Name Dark Matter from Different Vantage Points

Kaspar Hageman; René Rydhof Hansen; Jens Myrup Pedersen

doi:10.1007/978-3-030-91625-1_8

Gollector: Measuring Domain Name Dark Matter from Different Vantage Points

Kaspar Hageman^*, René Rydhof Hansen, Jens Myrup Pedersen

^*Kontaktforfatter

Publikation: Bidrag til bog/antologi/rapport/konference proceeding › Konferenceartikel i proceeding › Forskning › peer review

1 Citationer (Scopus)

Abstract

This paper proposes Gollector, a novel tool for measuring the domain name space from different vantage points. Whereas such measurements have typically been conducted from a single (or few) vantage point, our proposed solution combines multiple measurements in a single system. Gollector allows us to express the relative difference in the covered domain name space, and the temporal characteristics, as domain name dark matter. We leverage a three-week trace from four vantage points, by applying the tool to three security-related use cases: early domain registration detection, data leakage in a split-horizon situation, and a proposed method for subdomain enumeration. We release the Gollector source code to the research community to support future research in this field.

Originalsprog	Engelsk
Titel	Secure IT Systems : 26th Nordic Conference, NordSec 2021, Virtual Event, November 29–30, 2021, Proceedings
Redaktører	Nicola Tuveri, Antonis Michalas, Billy Bob Brumley
Antal sider	20
Forlag	Springer
Publikationsdato	2021
Sider	133-152
ISBN (Trykt)	978-3-030-91624-4
ISBN (Elektronisk)	978-3-030-91625-1
DOI	https://doi.org/10.1007/978-3-030-91625-1_8
Status	Udgivet - 2021
Begivenhed	26th Nordic Conference on Secure IT Systems, NordSec 2021 - Virtual, Online Varighed: 29 nov. 2021 → 30 nov. 2021

Konference

Konference	26th Nordic Conference on Secure IT Systems, NordSec 2021
By	Virtual, Online
Periode	29/11/2021 → 30/11/2021

Navn	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Vol/bind	13115 LNCS
ISSN	0302-9743

Bibliografisk note

Funding Information:
Acknowledgments. This research was carried out under the SecDNS project, funded by Innovation Fund Denmark. We would like to express our gratitude to Finn Büttner and Erwin Lansing for their assistance in collecting our passive DNS datasets.

Publisher Copyright:
© 2021, Springer Nature Switzerland AG.

Adgang til dokumentet

10.1007/978-3-030-91625-1_8

AUB Link

Søg efter materialet i Aalborg Universitetsbiblioteks søgemaskine

Andre filer og links

Link to publication in Scopus

Citationsformater

Hageman, Kaspar ; Hansen, René Rydhof ; Pedersen, Jens Myrup. / Gollector : Measuring Domain Name Dark Matter from Different Vantage Points. Secure IT Systems: 26th Nordic Conference, NordSec 2021, Virtual Event, November 29–30, 2021, Proceedings. red. / Nicola Tuveri ; Antonis Michalas ; Billy Bob Brumley. Springer, 2021. s. 133-152 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), Bind 13115 LNCS).

@inproceedings{ce2030e811c04c0aa04cfbe0f3a5df82,

title = "Gollector: Measuring Domain Name Dark Matter from Different Vantage Points",

abstract = "This paper proposes Gollector, a novel tool for measuring the domain name space from different vantage points. Whereas such measurements have typically been conducted from a single (or few) vantage point, our proposed solution combines multiple measurements in a single system. Gollector allows us to express the relative difference in the covered domain name space, and the temporal characteristics, as domain name dark matter. We leverage a three-week trace from four vantage points, by applying the tool to three security-related use cases: early domain registration detection, data leakage in a split-horizon situation, and a proposed method for subdomain enumeration. We release the Gollector source code to the research community to support future research in this field.",

keywords = "DNS, Domain names, Measurements, TLS",

author = "Kaspar Hageman and Hansen, {Ren{\'e} Rydhof} and Pedersen, {Jens Myrup}",

note = "Publisher Copyright: {\textcopyright} 2021, Springer Nature Switzerland AG.; 26th Nordic Conference on Secure IT Systems, NordSec 2021 ; Conference date: 29-11-2021 Through 30-11-2021",

year = "2021",

doi = "10.1007/978-3-030-91625-1_8",

language = "English",

isbn = "978-3-030-91624-4",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

publisher = "Springer",

pages = "133--152",

editor = "Nicola Tuveri and Antonis Michalas and Brumley, {Billy Bob}",

booktitle = "Secure IT Systems",

address = "Germany",

}

Hageman, K, Hansen, RR & Pedersen, JM 2021, Gollector: Measuring Domain Name Dark Matter from Different Vantage Points. i N Tuveri, A Michalas & BB Brumley (red), Secure IT Systems: 26th Nordic Conference, NordSec 2021, Virtual Event, November 29–30, 2021, Proceedings. Springer, Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), bind 13115 LNCS, s. 133-152, 26th Nordic Conference on Secure IT Systems, NordSec 2021, Virtual, Online, 29/11/2021. https://doi.org/10.1007/978-3-030-91625-1_8

Gollector: Measuring Domain Name Dark Matter from Different Vantage Points. / Hageman, Kaspar; Hansen, René Rydhof ; Pedersen, Jens Myrup.
Secure IT Systems: 26th Nordic Conference, NordSec 2021, Virtual Event, November 29–30, 2021, Proceedings. red. / Nicola Tuveri; Antonis Michalas; Billy Bob Brumley. Springer, 2021. s. 133-152 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), Bind 13115 LNCS).

Publikation: Bidrag til bog/antologi/rapport/konference proceeding › Konferenceartikel i proceeding › Forskning › peer review

TY - GEN

T1 - Gollector

T2 - 26th Nordic Conference on Secure IT Systems, NordSec 2021

AU - Hageman, Kaspar

AU - Hansen, René Rydhof

AU - Pedersen, Jens Myrup

PY - 2021

Y1 - 2021

N2 - This paper proposes Gollector, a novel tool for measuring the domain name space from different vantage points. Whereas such measurements have typically been conducted from a single (or few) vantage point, our proposed solution combines multiple measurements in a single system. Gollector allows us to express the relative difference in the covered domain name space, and the temporal characteristics, as domain name dark matter. We leverage a three-week trace from four vantage points, by applying the tool to three security-related use cases: early domain registration detection, data leakage in a split-horizon situation, and a proposed method for subdomain enumeration. We release the Gollector source code to the research community to support future research in this field.

AB - This paper proposes Gollector, a novel tool for measuring the domain name space from different vantage points. Whereas such measurements have typically been conducted from a single (or few) vantage point, our proposed solution combines multiple measurements in a single system. Gollector allows us to express the relative difference in the covered domain name space, and the temporal characteristics, as domain name dark matter. We leverage a three-week trace from four vantage points, by applying the tool to three security-related use cases: early domain registration detection, data leakage in a split-horizon situation, and a proposed method for subdomain enumeration. We release the Gollector source code to the research community to support future research in this field.

KW - DNS

KW - Domain names

KW - Measurements

KW - TLS

UR - http://www.scopus.com/inward/record.url?scp=85119851398&partnerID=8YFLogxK

U2 - 10.1007/978-3-030-91625-1_8

DO - 10.1007/978-3-030-91625-1_8

M3 - Article in proceeding

AN - SCOPUS:85119851398

SN - 978-3-030-91624-4

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 133

EP - 152

BT - Secure IT Systems

A2 - Tuveri, Nicola

A2 - Michalas, Antonis

A2 - Brumley, Billy Bob

PB - Springer

Y2 - 29 November 2021 through 30 November 2021

ER -

Hageman K, Hansen RR , Pedersen JM. Gollector: Measuring Domain Name Dark Matter from Different Vantage Points. I Tuveri N, Michalas A, Brumley BB, red., Secure IT Systems: 26th Nordic Conference, NordSec 2021, Virtual Event, November 29–30, 2021, Proceedings. Springer. 2021. s. 133-152. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), Bind 13115 LNCS). doi: 10.1007/978-3-030-91625-1_8

Gollector: Measuring Domain Name Dark Matter from Different Vantage Points

Abstract

Konference

Bibliografisk note

Adgang til dokumentet

AUB Link

Andre filer og links

Fingeraftryk

Citationsformater