Gollector: Measuring Domain Name Dark Matter from Different Vantage Points

Kaspar Hageman; René Rydhof Hansen; Jens Myrup Pedersen

doi:10.1007/978-3-030-91625-1_8

Gollector: Measuring Domain Name Dark Matter from Different Vantage Points

Kaspar Hageman^*, René Rydhof Hansen, Jens Myrup Pedersen

^*Corresponding author for this work

Research output: Contribution to book/anthology/report/conference proceeding › Article in proceeding › Research › peer-review

1 Citation (Scopus)

Abstract

This paper proposes Gollector, a novel tool for measuring the domain name space from different vantage points. Whereas such measurements have typically been conducted from a single (or few) vantage point, our proposed solution combines multiple measurements in a single system. Gollector allows us to express the relative difference in the covered domain name space, and the temporal characteristics, as domain name dark matter. We leverage a three-week trace from four vantage points, by applying the tool to three security-related use cases: early domain registration detection, data leakage in a split-horizon situation, and a proposed method for subdomain enumeration. We release the Gollector source code to the research community to support future research in this field.

Original language	English
Title of host publication	Secure IT Systems : 26th Nordic Conference, NordSec 2021, Virtual Event, November 29–30, 2021, Proceedings
Editors	Nicola Tuveri, Antonis Michalas, Billy Bob Brumley
Number of pages	20
Publisher	Springer
Publication date	2021
Pages	133-152
ISBN (Print)	978-3-030-91624-4
ISBN (Electronic)	978-3-030-91625-1
DOIs	https://doi.org/10.1007/978-3-030-91625-1_8
Publication status	Published - 2021
Event	26th Nordic Conference on Secure IT Systems, NordSec 2021 - Virtual, Online Duration: 29 Nov 2021 → 30 Nov 2021

Conference

Conference	26th Nordic Conference on Secure IT Systems, NordSec 2021
City	Virtual, Online
Period	29/11/2021 → 30/11/2021

Series	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	13115 LNCS
ISSN	0302-9743

Bibliographical note

Publisher Copyright:
© 2021, Springer Nature Switzerland AG.

Keywords

DNS
Domain names
Measurements
TLS

Access to Document

10.1007/978-3-030-91625-1_8

AUB Link

Search for the material in Aalborg University Library's search engine

Cite this

Hageman, Kaspar ; Hansen, René Rydhof ; Pedersen, Jens Myrup. / Gollector : Measuring Domain Name Dark Matter from Different Vantage Points. Secure IT Systems: 26th Nordic Conference, NordSec 2021, Virtual Event, November 29–30, 2021, Proceedings. editor / Nicola Tuveri ; Antonis Michalas ; Billy Bob Brumley. Springer, 2021. pp. 133-152 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), Vol. 13115 LNCS).

@inproceedings{ce2030e811c04c0aa04cfbe0f3a5df82,

title = "Gollector: Measuring Domain Name Dark Matter from Different Vantage Points",

abstract = "This paper proposes Gollector, a novel tool for measuring the domain name space from different vantage points. Whereas such measurements have typically been conducted from a single (or few) vantage point, our proposed solution combines multiple measurements in a single system. Gollector allows us to express the relative difference in the covered domain name space, and the temporal characteristics, as domain name dark matter. We leverage a three-week trace from four vantage points, by applying the tool to three security-related use cases: early domain registration detection, data leakage in a split-horizon situation, and a proposed method for subdomain enumeration. We release the Gollector source code to the research community to support future research in this field.",

keywords = "DNS, Domain names, Measurements, TLS",

author = "Kaspar Hageman and Hansen, {Ren{\'e} Rydhof} and Pedersen, {Jens Myrup}",

note = "Publisher Copyright: {\textcopyright} 2021, Springer Nature Switzerland AG.; 26th Nordic Conference on Secure IT Systems, NordSec 2021 ; Conference date: 29-11-2021 Through 30-11-2021",

year = "2021",

doi = "10.1007/978-3-030-91625-1_8",

language = "English",

isbn = "978-3-030-91624-4",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

publisher = "Springer",

pages = "133--152",

editor = "Nicola Tuveri and Antonis Michalas and Brumley, {Billy Bob}",

booktitle = "Secure IT Systems",

address = "Germany",

}

Hageman, K, Hansen, RR & Pedersen, JM 2021, Gollector: Measuring Domain Name Dark Matter from Different Vantage Points. in N Tuveri, A Michalas & BB Brumley (eds), Secure IT Systems: 26th Nordic Conference, NordSec 2021, Virtual Event, November 29–30, 2021, Proceedings. Springer, Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 13115 LNCS, pp. 133-152, 26th Nordic Conference on Secure IT Systems, NordSec 2021, Virtual, Online, 29/11/2021. https://doi.org/10.1007/978-3-030-91625-1_8

Gollector: Measuring Domain Name Dark Matter from Different Vantage Points. / Hageman, Kaspar; Hansen, René Rydhof ; Pedersen, Jens Myrup.
Secure IT Systems: 26th Nordic Conference, NordSec 2021, Virtual Event, November 29–30, 2021, Proceedings. ed. / Nicola Tuveri; Antonis Michalas; Billy Bob Brumley. Springer, 2021. p. 133-152 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), Vol. 13115 LNCS).

Research output: Contribution to book/anthology/report/conference proceeding › Article in proceeding › Research › peer-review

TY - GEN

T1 - Gollector

T2 - 26th Nordic Conference on Secure IT Systems, NordSec 2021

AU - Hageman, Kaspar

AU - Hansen, René Rydhof

AU - Pedersen, Jens Myrup

PY - 2021

Y1 - 2021

N2 - This paper proposes Gollector, a novel tool for measuring the domain name space from different vantage points. Whereas such measurements have typically been conducted from a single (or few) vantage point, our proposed solution combines multiple measurements in a single system. Gollector allows us to express the relative difference in the covered domain name space, and the temporal characteristics, as domain name dark matter. We leverage a three-week trace from four vantage points, by applying the tool to three security-related use cases: early domain registration detection, data leakage in a split-horizon situation, and a proposed method for subdomain enumeration. We release the Gollector source code to the research community to support future research in this field.

AB - This paper proposes Gollector, a novel tool for measuring the domain name space from different vantage points. Whereas such measurements have typically been conducted from a single (or few) vantage point, our proposed solution combines multiple measurements in a single system. Gollector allows us to express the relative difference in the covered domain name space, and the temporal characteristics, as domain name dark matter. We leverage a three-week trace from four vantage points, by applying the tool to three security-related use cases: early domain registration detection, data leakage in a split-horizon situation, and a proposed method for subdomain enumeration. We release the Gollector source code to the research community to support future research in this field.

KW - DNS

KW - Domain names

KW - Measurements

KW - TLS

UR - http://www.scopus.com/inward/record.url?scp=85119851398&partnerID=8YFLogxK

U2 - 10.1007/978-3-030-91625-1_8

DO - 10.1007/978-3-030-91625-1_8

M3 - Article in proceeding

AN - SCOPUS:85119851398

SN - 978-3-030-91624-4

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 133

EP - 152

BT - Secure IT Systems

A2 - Tuveri, Nicola

A2 - Michalas, Antonis

A2 - Brumley, Billy Bob

PB - Springer

Y2 - 29 November 2021 through 30 November 2021

ER -

Hageman K, Hansen RR , Pedersen JM. Gollector: Measuring Domain Name Dark Matter from Different Vantage Points. In Tuveri N, Michalas A, Brumley BB, editors, Secure IT Systems: 26th Nordic Conference, NordSec 2021, Virtual Event, November 29–30, 2021, Proceedings. Springer. 2021. p. 133-152. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), Vol. 13115 LNCS). doi: 10.1007/978-3-030-91625-1_8

Gollector: Measuring Domain Name Dark Matter from Different Vantage Points

Abstract

Conference

Bibliographical note

Keywords

Access to Document

AUB Link

Other files and links

Fingerprint

Cite this