682557 event 1748414104 1748414215 <![CDATA[Ph.D. Proposal Oral Exam - Aaron Faulkenberry]]> Title:  Internet-Scale Discovery and Measurement of DNS Monitoring for Cyber Threats

Committee:

Dr. Antonakakis, Advisor

Dr. Monrose, Chair

Dr. Keromytis

Dr. Perdisci

Dr. Ma

]]> The object of the proposed research is to understand how the security community tracks the domain infrastructure of cyber threats to uncover blind spots that adversaries exploit to hide their attacks. Our findings come from internet-scale measurement and analysis of real-world DNS monitoring deployments. First, we find evidence of DNS monitoring by security entities in the upper DNS hierarchy for malware-related domains, and our temporal analysis suggests that these monitors may lack visibility into the early stages of attacks. In response, we designed and implemented a novel system that stimulates reactive DNS monitoring deployments in networks across IPv4. Our system reveals DNS monitoring affecting tens of thousands of autonomous systems and includes the characterization of automated analysis pipelines, which provide sweeping monitoring coverage across distinct networks. However, various monitoring implementations left room for attackers to profile monitors and undermine the security community's defenses. As remaining work, we propose designing a new study to illuminate proactive DNS monitoring and uncover security community blind spots of malicious infrastructure during its provisioning.

]]> <![CDATA[]]> 434371 1788 102851 1808