Application attacks on the Internet, such as email and blog spam,
phishing, and click fraud, manipulate network applications to
victimize users.  Such attacks rely on network services to efficiently
and stealthily coordinate attack activities.  Infected computers often
use look-up services to locate the command-and-control servers and
receive instructions.  Hosting services allow the storage and exchange
of attack-related data (e.g., malware or stolen information),
analogous to the use of "drop sites" in the physical world. Finally,
malware takes advantage of protocols to connect to intended victims.
Such attacks therefore often result in observable service violations
and anomalies because the activities of infected computers are
different from normal user activity.

This project developed a better understanding of how current and
future attacks might be launched and detected.  In particular, we
sought to identify the basic network services that are necessary for
large-scale attacks, and developed new analysis and detection
algorithms and infrastructures to monitor these service activities to
detect and predict attacks.

Much of the research at UNC focused on the Domain Name System (DNS),
which is a globally distributed collection of "name servers" and
associated protocols for mapping user-friendly domain names (e.g.,
"nytimes.com") to the Internet Protocol (IP) addresses used to route
packets to/from their websites.

- A growing trend in optimizing the speed of web browsers is to
prefetch DNS resolutions for domains in hyperlinks, in case the user
clicks on one.  We showed that if left unchecked, DNS prefetching
could lead to new security and privacy abuses.

- The importance of domain names for resale, serving ad content, or
launching malware has contributed to the rise of questionable
practices in acquiring them. Our accomplishments included one of the
first comprehensive studies of abusive domain-registration practices.
We explored ways to automatically generate high-quality domain names
related to current events to measure domain "front running" by
registrars and "speculation" by others.

- We studied techniques for detecting algorithmically generated
domains (AGDs) that are automatically generated to minimize collisions
with others.  Although such domains are used by malware to thwart
defenses, they are also used for benign purposes.  The rise of these
benign applications negatively impacts the ability to accurately
classify malicious AGDs.  We studied current uses of and existing
detection mechanisms for AGDs, and then developed better techniques
for identifying infected computers using AGDs.

Outside the context of DNS specifically, we also developed
technologies and explored threats relevant to Internet defense:

- A requirement in some types of Internet monitoring is repeatedly
probing some set of targets over time.  While some probers exercise
restraint to limit collateral damage of their probing, the literature
is rife with examples of what many might consider egregious practices.
We developed efficient probing algorithms and tools to more
responsibly manage probing.

- Due to existing router support for collecting network traffic
summaries called flow records, there is increasing attention being
devoted to performing network anomaly detection using flow records.
We explored the limits of analysis using flow records for security
purposes, by investigating to what extent an attacker who compromises
machines in an enterprise, for example, can perform his activities in
a way that is undetectable in...

Please report errors in award information by writing to: awardsearch@nsf.gov.