Logo
ICANN
ICANN
Filtered Search

Are you sure you want to sign out from https://www.icann.org?

If you want to sign out from both https://www.icann.org and ICANN Account, click here.

ICANN 博文

敬请阅读 ICANN 的博文，了解最新政策制定活动和区域事务等等。

恶意域名注册的推断分析 (INFERMAL) 项目：恶意域名注册的特征分析

2024 年 10 月 24 日
作者： Prof. Maciej Korczyński 和
Samaneh Tajalizadehkhoob, Ph.D.

Samaneh Tajalizadehkhoob, Ph.D.

Director, Security, Stability and Resiliency Research

Samaneh is a Principal Security, Stability & Resiliency (SSR) Specialist reporting to John Crain, Chief Security, Stability & Resiliency Officer and is part of the Office of CTO (OCTO) group. She is based in ICANN’s Europe Region and will be working remotely from the Netherlands. As the SSR Specialist, Samaneh works in close coordination with other ICANN organization functions to implement ICANN’s Security, Stability and Resiliency strategies. Samaneh carries out research on DNS security and abuse. She also represents ICANN on matters relating to the SSR of the Internet’s system of unique identifiers within ICANN’s remit as well as helping to develop technical work, positions and produce materials related to the administration of those identifiers from an SSR perspective.

Samaneh is from a multi-disciplinary background. While she is an Electronics Engineer by training, she studied Engineering and Policy Analysis for her masters. She holds a PhD degree in Internet Security and Data Analytics from the Delft University of Technology in the Netherlands. She worked as a Post-Doctoral researcher at the same university where she did research on banking security and underground markets utilizing advanced statistical techniques and machine learning.

She has collaborated with other research teams as a visiting scholar; at KU Leuven, DistriNet Research Group she worked on Internet measurements to estimate web vulnerabilities and measure patching practices of hosting servers. Additionally, she worked with scholars from the security and privacy lab at University of Innsbruck on designing abuse metrics that can reliably measure security performance of Internet identifiers.

Samaneh has authored publications on web security, cyber security, Internet measurements, underground economy, and development of security metrics design using advance statistical methods.

Samaneh speaks English, Farsi, Dutch and has basic knowledge in Arabic. She is a big fan of board games. In her free time, she runs, plays tennis, and piano.

 

恶意域名注册的推断分析 (Inferential Analysis of Maliciously Registered Domains, INFERMAL) 项目由 ICANN 资助，由 KOR 实验室 (KOR Labs) 负责实施，旨在了解网络犯罪分子在钓鱼活动中偏好特定域名注册服务机构和顶级域 (top-level domains, TLD) 的选择模式。此举旨在分析某些注册服务机构和 TLD 对攻击者特别具有吸引力的因素，重点关注预先选定的三个类别：注册属性、主动验证和被动安全措施。

预选分析特征

注册属性

这些属性包括注册服务机构提供的、可能被恶意行为者利用的服务和政策：

  1. 域名注册价格：此前工作（即《通用顶级域 (gTLD) 中域名系统 (DNS) 滥用的统计数据分析》）表明，定价策略可能会影响网络犯罪分子的行为，尤其是那些预算紧张的网络犯罪分子。INFERMAL 项目探讨了不同的定价结构如何影响恶意注册的潜力。
  2. 折扣：批量注册折扣对于希望扩大运营规模的攻击者极具吸引力。我们的分析研究了这些折扣与域名滥用率之间的相关性。
  3. 可用支付方式：网络犯罪分子通常更喜欢能够保证匿名的支付方式，例如加密货币。这项工作研究了 13 种支付方式，评估它们对恶意注册造成的影响。
  4. 应用程序编程接口 (API) 访问：不受限的 API 访问使得快速建立恶意行为基础设施成为可能。这项研究分析了自动注册访问的便利性如何助长了域名滥用，包括人们对批量注册选项的青睐。
  5. 免费服务：提供托管或安全传输层协议 (TLS) 证书等免费服务的注册服务机构可大大降低攻击者的运营成本。网络犯罪分子可以利用这些免费服务实现资本化，以最少投资创建钓鱼网站。

主动验证

该类别包括注册服务机构在注册过程中验证注册人信息的各种措施：

  1. 注册人信息的运营验证：验证联系信息（如电子邮件地址和电话号码）时的差异，可能会为攻击者创造漏洞。INFERMAL 则旨在研究这些差异如何影响恶意注册的难易程度。
  2. 注册限制：本地业务要求和身份验证要求可以遏制网络犯罪分子。这项工作评估了严格的限制如何影响攻击者对注册服务机构的选择。
  3. 域名注册警告和预防：发出警告或阻止可疑注册的注册服务机构可能会遏制攻击者。我们的研究将检验这些预防措施的有效性。

被动安全措施

被动措施关注注册服务机构如何应对检测到的滥用行为：

  1. 恶意域名的活跃时间：了解恶意域名在受到遏制之前保持活跃的时间至关重要。INFERMAL 项目分析了这些域名的活跃时间以及被列入禁用名单后的被遏制速度。

特征工程

为了改善我们的分析，INFERMAL 整合了相关特征。例如，多种支付方式被归为更广泛的类别（例如“支付加密”、“支付数字钱包”），各种安全限制则被汇总成一个综合指标。这种方法提高了模型的诠释性和可靠性。

结论

我们的研究通过检查注册属性、主动验证和被动安全措施，旨在阐明造成恶意域名注册的因素。这项分析不仅揭示了域名滥用的机制，还强调了注册领域内恶意活动的复杂性。

后续工作有哪些？

特征选取是 INFERMAL 项目最终分析的下一步工作。在特征选取和收集完成后，项目负责人将建立统计模型，以了解某些特征在 DNS 滥用中起作用的原因和程度。这是该项目的最后一个交付项：INFERMAL 的最终报告。

根据我们的协议，最终报告将于 10 月底呈交给首席技术官办公室的安全、稳定与弹性团队。在此之后，我们将进行内部审核。
我们希望于 2024 年 11 月初，即 ICANN81 届会议召开前，向我们的社群发布这份 INFERMAL 报告。

Authors

Prof. Maciej Korczyński

(KOR Labs)
Samaneh Tajalizadehkhoob, Ph.D.

Samaneh Tajalizadehkhoob, Ph.D.

Director, Security, Stability and Resiliency Research
Samaneh Tajalizadehkhoob, Ph.D.

Samaneh Tajalizadehkhoob, Ph.D.

Director, Security, Stability and Resiliency Research

Samaneh is a Principal Security, Stability & Resiliency (SSR) Specialist reporting to John Crain, Chief Security, Stability & Resiliency Officer and is part of the Office of CTO (OCTO) group. She is based in ICANN’s Europe Region and will be working remotely from the Netherlands. As the SSR Specialist, Samaneh works in close coordination with other ICANN organization functions to implement ICANN’s Security, Stability and Resiliency strategies. Samaneh carries out research on DNS security and abuse. She also represents ICANN on matters relating to the SSR of the Internet’s system of unique identifiers within ICANN’s remit as well as helping to develop technical work, positions and produce materials related to the administration of those identifiers from an SSR perspective.

Samaneh is from a multi-disciplinary background. While she is an Electronics Engineer by training, she studied Engineering and Policy Analysis for her masters. She holds a PhD degree in Internet Security and Data Analytics from the Delft University of Technology in the Netherlands. She worked as a Post-Doctoral researcher at the same university where she did research on banking security and underground markets utilizing advanced statistical techniques and machine learning.

She has collaborated with other research teams as a visiting scholar; at KU Leuven, DistriNet Research Group she worked on Internet measurements to estimate web vulnerabilities and measure patching practices of hosting servers. Additionally, she worked with scholars from the security and privacy lab at University of Innsbruck on designing abuse metrics that can reliably measure security performance of Internet identifiers.

Samaneh has authored publications on web security, cyber security, Internet measurements, underground economy, and development of security metrics design using advance statistical methods.

Samaneh speaks English, Farsi, Dutch and has basic knowledge in Arabic. She is a big fan of board games. In her free time, she runs, plays tennis, and piano.

 

您还可能喜欢