Name Service Research Articles

Anomaly Detection and Approximate Similarity Searches of Transients in Real-time Data Streams

We present Lightcurve Anomaly Identification and Similarity Search (LAISS), an automated pipeline to detect anomalous astrophysical transients in real-time data streams. We deploy our anomaly detection model on the nightly Zwicky Transient Facility (ZTF) Alert Stream via the ANTARES broker, identifying a manageable ∼1–5 candidates per night for expert vetting and coordinating follow-up observations. Our method leverages statistical light-curve and contextual host galaxy features within a random forest classifier, tagging transients of rare classes (spectroscopic anomalies), of uncommon host galaxy environments (contextual anomalies), and of peculiar or interaction-powered phenomena (behavioral anomalies). Moreover, we demonstrate the power of a low-latency (∼ms) approximate similarity search method to find transient analogs with similar light-curve evolution and host galaxy environments. We use analogs for data-driven discovery, characterization, (re)classification, and imputation in retrospective and real-time searches. To date, we have identified ∼50 previously known and previously missed rare transients from real-time and retrospective searches, including but not limited to superluminous supernovae (SLSNe), tidal disruption events, SNe IIn, SNe IIb, SNe I-CSM, SNe Ia-91bg-like, SNe Ib, SNe Ic, SNe Ic-BL, and M31 novae. Lastly, we report the discovery of 325 total transients, all observed between 2018 and 2021 and absent from public catalogs (∼1% of all ZTF Astronomical Transient reports to the Transient Name Server through 2021). These methods enable a systematic approach to finding the “needle in the haystack” in large-volume data streams. Because of its integration with the ANTARES broker, LAISS is built to detect exciting transients in Rubin data.

A Long Short Term Memory Model for Character-based Analysis of DNS Tunneling Detection

DNS tunneling is the attempt to create a hidden tunnel through a domain name service. Such a tunnel would jeopardize the targeted network and open the door for illegal access, control, and data exfiltration. The information security research community showed the variety of techniques that have been proposed to detect the tunnel. The majority of these efforts were relying on machine learning techniques where features of tunneling are considered such as length of DNS query, size, and entropy of the query. However, an additional analysis of the lexical information of the DNS query has been depicted recently and showed remarkable performance. This paper aims to examine the role of Long Short Term Memory (LSTM) model in terms of DNS lexical analysis. Two benchmark datasets related to DNS have been used. In addition, a character mapping mechanism has been used to replace every possible character with an integer number. Consequentially, the mapped representation has been fed into an LSTM model for DNS tunneling detection. Results showed that the proposed method was able to obtain a weighted average F1-score of 98% for both datasets respectively. Such results are competitive in the context of the state of the art and demonstrate the efficacy of the lexical analysis within the DNS tunneling detection task.

BeHarmony: Blockchain-Enabled Trustworthy Communication and Legitimate Decision Making in Multi-Party Internet of Vehicles Systems

The rapid development of the Internet of Vehicles using centralized systems faces significant challenges, including reliability and security vulnerabilities and high latency. This paper introduces a blockchain-enabled authentication and communication network for scalable IoV to enhance security, reduce latency, and relieve the dependency on centralized infrastructures. The network applies blockchain-enabled domain name services and mutual authentication for fault tolerance consensus, such as PBFT and RAFT, featuring a primary layer of road side units and edge servers for inter-vehicle communication and a sub-layer within each vehicle for intra-vehicle communication. The study evaluates various scenarios and assesses roadside unit availability based on random distribution along vehicle routes. This paper also discusses the legal issues involved in the proposed model, highlighting that the IoV system should be governed by a contract-based decentralized IoV system comprising both smart contracts and traditional contracts. This model offers a novel approach to developing a decentralized, secure, efficient, and ethical IoV ecosystem, advancing autonomous and reliable vehicular networks.

Analyzing voting power in decentralized governance: Who controls DAOs?

We empirically study the state of three prominent DAO governance systems on the Ethereum blockchain: Compound, Uniswap and Ethereum name service (ENS). In particular, we examine how the voting power is distributed in these systems. Using a comprehensive dataset of all governance token holders, delegates, proposals, and votes, we analyze who holds the voting power and how this power is being used to influence governance decisions. While we reveal that the majority of voting power is concentrated in the hands of a small number of addresses, we rarely observe these powerful entities overturning a vote by choosing a different outcome than that of the overall community and less influential voters.

Securing the Web

In an era characterized by the ubiquity of the internet, the proliferation of online services, and the increasing frequency of cyber threats, the detection of look-alike domains has become a critical component of cybersecurity. The current paper presents an approach for the detection of look-alike domains, leveraging the power of open-source intelligence (OSINT) tools. It included gathering and analyzing a wide range of publicly available data sources, including permutations, WHOIS records, IP information, website content, Geo IP, similarity percentage, name server, and mail server records, and building a comprehensive profile of domains under investigation. Through the application of online search engines, patterns and features that distinguish legitimate domains from their deceptive counterparts were established. The analysis demonstrated that OSINT tools provided significant information about the sample domains and successfully detected 1598 registered look-alike domains among 10 sample domains using dnstwist, while OpenSquat identified 103 squatting domains, 960 active phishing websites, and 53 domains with suspicious certificates across five sample websites. The research contributes to the enhancement of cybersecurity practices by providing a cost-effective and scalable solution for identifying look-alike domains, which can serve as precursors to various online threats, including phishing attacks, malware distribution, and fraud.

Intelligent model for the detection and classification of encrypted network traffic in cloud infrastructure

This article explores detecting and categorizing network traffic data using machine-learning (ML) methods, specifically focusing on the Domain Name Server (DNS) protocol. DNS has long been susceptible to various security flaws, frequently exploited over time, making DNS abuse a major concern in cybersecurity. Despite advanced attack, tactics employed by attackers to steal data in real-time, ensuring security and privacy for DNS queries and answers remains challenging. The evolving landscape of internet services has allowed attackers to launch cyber-attacks on computer networks. However, implementing Secure Socket Layer (SSL)-encrypted Hyper Text Transfer Protocol (HTTP) transmission, known as HTTPS, has significantly reduced DNS-based assaults. To further enhance security and mitigate threats like man-in-the-middle attacks, the security community has developed the concept of DNS over HTTPS (DoH). DoH aims to combat the eavesdropping and tampering of DNS data during communication. This study employs a ML-based classification approach on a dataset for traffic analysis. The AdaBoost model effectively classified Malicious and Non-DoH traffic, with accuracies of 75% and 73% for DoH traffic. The support vector classification model with a Radial Basis Function (SVC-RBF) achieved a 76% accuracy in classifying between malicious and non-DoH traffic. The quadratic discriminant analysis (QDA) model achieved 99% accuracy in classifying malicious traffic and 98% in classifying non-DoH traffic.

Analyzing Network Time Protocol (NTP) Based Amplification DDoS Attack and its Mitigation Techniques

Network Time Protocol amplification attack is a form of distributed denial-of-service (DDoS) attack in which an attacker exploits or sends a request to a vulnerable NTP server by using their IP address to flood a targeted network or server with an overwhelming volume of User Datagram Protocol (UDP) traffic. In the past, the techniques that involved reflecting traffic off NTP servers to the victim, with the attacker hiding their identity by spoofing the source IP address were carried out using mainly Domain Name Server (DNS) servers but the use of vulnerable NTP servers as reflectors in DDoS attacks has gain lot of popularity since 2014, and this is as a result of the realization of high amplification scale that NTP servers can provide. This type of reflector attack maximized the use of the amplification factor of NTP servers to magnify the attack bandwidth, making it particularly disruptive and difficult to mitigate. Since NTP amplification is not a popularly known attack and there has not been much thorough research on it, this paper explores a holistic overview of NTP amplification attacks, how NTP is used for DDoS attacks, and the overall method that can be used to mitigate such attacks. Keywords: Distributed Denial-of-Service (DDoS) attack, DNS servers, NTP servers

Analyzing Network Time Protocol (NTP) Based Amplification DDoS Attack and its Mitigation Techniques

Network Time Protocol amplification attack is a form of distributed denial-of-service (DDoS) attack in which an attacker exploits or sends a request to a vulnerable NTP server by using their IP address to flood a targeted network or server with an overwhelming volume of User Datagram Protocol (UDP) traffic. In the past, the techniques that involved reflecting traffic off NTP servers to the victim, with the attacker hiding their identity by spoofing the source IP address were carried out using mainly Domain Name Server (DNS) servers but the use of vulnerable NTP servers as reflectors in DDoS attacks has gain lot of popularity since 2014, and this is as a result of the realization of high amplification scale that NTP servers can provide. This type of reflector attack maximized the use of the amplification factor of NTP servers to magnify the attack bandwidth, making it particularly disruptive and difficult to mitigate. Since NTP amplification is not a popularly known attack and there has not been much thorough research on it, this paper explores a holistic overview of NTP amplification attacks, how NTP is used for DDoS attacks, and the overall method that can be used to mitigate such attacks. Keywords: Distributed Denial-of-Service (DDoS) attack, DNS servers, NTP servers

Reducing DNS Traffic to Enhance Home IoT Device Privacy.

The deployment of Internet of Things (IoT) devices is widespread in different environments, including homes. Although security is incorporated, homes can become targets for cyberattacks because of their vulnerabilities. IoT devices generate Domain Name Server (DNS) traffic primarily for communication with Internet servers. In this paper, we present a detailed analysis of DNS traffic from IoT devices. The queried domains are highly distinctive, enabling attackers to easily identify the IoT device. In addition, we observed an unexpectedly high volume of queries. The analysis reveals that the same domains are repeatedly queried, DNS queries are transmitted in plain text over User Datagram Protocol (UDP) port 53 (Do53), and the excessive generation of traffic poses a security risk by amplifying an attacker's ability to identify IoT devices and execute more precise, targeted attacks, consequently escalating the potential compromise of the entire IoT ecosystem. We propose a simple measure that can be taken to reduce DNS traffic generated by IoT devices, thus preventing it from being used as a vector to identify the types of devices present in the network. This measure is based on the implementation of the DNS cache in the devices; caching few resources increases privacy considerably.

The statistics and environments of hostless supernovae

ABSTRACT Transient surveys routinely detect supernovae (SNe) without obvious host galaxies. To understand the demographics of these ‘hostless’ SNe and to constrain the possible host properties, we identify 161 SNe reported to the Transient Name Server since 2016 that do not have hosts catalogued from pre-explosion wide-field galaxy surveys. Using forced aperture photometry, we detect excess flux around only 56 of these SNe. Both thermonuclear and core-collapse (CC) SNe are present in our sample. Compared to flux-limited SNe samples with known hosts, superluminous supernovae (SLSNe), particularly hydrogen-deficient SLSNe, are over-represented here relative to all other SNe types; among CC SNe, there is also a higher fraction of interacting SNe than non-interacting. On the low-luminosity side, seven SNe have host absolute magnitude upper limits fainter than Mg = −12, about 1 per cent of the Small Magellanic Cloud’s luminosity; the faintest limits are close to the luminosity of globular clusters or ultra-faint dwarf galaxies (Mg ≃ −8). Fitting multiband forced photometry, 11 SNe have host stellar masses <106 M⊙ assuming quiescent hosts, and 13 SNe have host stellar masses <105 M⊙ assuming star-forming hosts. The spatial distribution of hostless SNe indicates that the majority are not associated with known galaxy groups and clusters, ruling out intracluster stellar light as the primary contributor of such SNe. Hostless Type Ia SNe tend to be more luminous and slow-fading than SNe Ia with known host galaxies, implying a hidden population of low-mass and star-forming hosts. We conclude that any undetected host galaxies are likely star-forming dwarfs in the field.

MIS: A Multi-Identifier Management and Resolution System in the Metaverse

The metaverse gradually evolves into a virtual world containing a series of interconnected sub-metaverses. Diverse digital resources, including identities, contents, services, and supporting data, are key components of the sub-metaverse. Therefore, a Domain Name System (DNS)-like system is necessary for efficient management and resolution. However, the legacy DNS was designed with security vulnerabilities and trust risks due to centralized issues. Blockchain is used to mitigate these concerns due to its decentralized features. Additionally, it supports identity management as a default feature, making it a natural fit for the metaverse. While there are several DNS alternatives based on the blockchain, they either manage only a single type of identifiers or isolate identities from other sorts of identifiers, making it difficult for sub-metaverses to coexist and connect with each other. This article proposes a M ulti- I dentifier management and resolution S ystem (MIS) in the metaverse, supporting the registration, resolution, and inter-translation functions. The basic MIS is portrayed as a four-tier architecture on a consortium blockchain due to its manageability, enhanced security, and efficiency properties. On-chain data is lightweight and compressed to save on storage while accelerating reading and writing operations. The resource data is encrypted based on the attributes of the sub-metaverse in the storage tier for privacy protection and access control. For users with decentralization priorities, a modification named EMIS is built on top of Ethereum. Finally, MIS is implemented on two testbeds and is available online as the open-source system. The first testbed consists of 4 physical servers located in the UK and Malaysia while the second is made up of 200 virtual machines (VMs) spread over 26 countries across all 5 continents on Google Cloud. Experiments indicate that MIS provides efficient reading and writing performance than the legacy DNS and other public blockchain-based workarounds including EMIS and Ethereum Name Service (ENS).

Government Effectiveness Moderation On The Effect Of Per Capita Income And Exchange Rate On Goods And Services Tax Revenue In East Asia And Pacific

Taxes have been known as the main source of revenue in every country. Tax on Goods and Services is a clear example of how tax revenue can contribute as a source of government revenue. This type of tax has been implemented in more than 143 countries in the world under the name Goods and Services Tax (GST) or Value Added Tax (VAT), including developed and developing countries which are members of the East Asia and Pacific region. Over the past few years, the issue of GST has become a hot topic of discussion as an approach in fiscal policy to reduce the budget deficit. New challenges and risks arose in line with the efforts of policy makers to maintain and accelerate economic growth in the East Asia and Pacific region. Deglobalization, population aging, and climate change overshadow the prospects for economic growth in this region, which has initially developed rapidly through trade. This research contributes to presenting the results of empirical literature regarding the determinants of tax revenue on goods and services in 12 countries that are members of the East Asia and Pacific region during the 2010-2019 period. Through a quantitative approach and panel data regression analysis method, the results show that the dependent variable GST can be explained by the independent variables consisting of Per Capita Income (PCI) and Exchange Rate (EXCH) of 56.42%. Per Capita Income, Exchange Rate has a positive and significant effect on Goods and Services Tax revenue. Meanwhile, moderation by the Government Effectiveness variable weakens the influence of the two independent variables so that the PCI and EXCH coefficient values become negative. This study also uses the variable Service Sector Contribution to GDP (SERV) as a control variable.

A Study On Factors Influencing Consumer Buying Behaviour Towards Purchase Of Smart Phones With Reference To Bengaluru

The purpose of this study is to look at the factors affecting people's decisions to buy mobile phone gadgets in Bengaluru town. To achieve the goals of the study, a sample of 100 clients was selected using a straightforward random sampling procedure. We looked at both primary and secondary data. Other considerations included Price, social class, product characteristics, brand name, durability, and after-sales services. Multiple regression analysis and correlation were used to select and evaluate the data. Analysis revealed that it was evident that consumers consider pricing to be the most significant factor among all other factors, followed by mobile phone functionality. Additionally, it served as a motivating factor in their choice to get a mobile phone. The research recommended that the smart phone vendors should take into account the following elements while comparing the possibility.

Overcoming challenges in deep inspect of vpn and proxy by deep learning

The rapid growth of proxying and VPN techniques has presented formidable challenges for internet operators in classifying network traffic. These methods not only hinder effective traffic policing and resource restriction but also introduce complexities by allowing VPNs to masquerade under application protocols. Furthermore, the increasing popularity of applications like Voice over IP (VoIP) and peer-to-peer (P2P) technologies further exacerbates the difficulty in controlling and classifying such traffic. Conventional techniques like Server Name Indication (SNI) analysis are witnessing diminishing effectiveness over time. Network providers now face the critical task of acquiring detailed knowledge about the specific applications and protocols utilised by their customers, enabling them to accurately allocate resources and ensure robust traffic management in this challenging landscape.

Detection of Phishing Websites Hosted in Name Server Flux Networks Using Machine Learning

Detection of Phishing Websites Hosted in Name Server Flux Networks Using Machine Learning

FairNet: A Measurement Framework for Traffic Discrimination Detection on the Internet

Network neutrality is related to the nondiscriminatory treatment of packets on the Internet. Any deliberate discrimination of traffic of one application while favoring others violates the principle of neutrality. Many countries have enforced laws against such discrimination. One requires tools to detect any net neutrality violations to enforce such laws. However, detecting such violations is challenging as it is hard to separate any degradation in quality due to natural network effects and selective degradation. Also, legitimate traffic management and deliberate discrimination methods can be technically the same, making it challenging to distinguish them further. We developed an end-to-end measurement framework named FairNet to detect discrimination of traffic. It compares the performance of similar services. Our focus is on HTTPS streaming services which constitute a predominant portion of the Internet traffic. The effect of confounding factors (congestion, traffic management policy, dynamic rate adaptation) is made similar on the test services to ensure a fair comparison. FairNet framework uses a replay server and user-client that exchanges correctly identifiable traffic streams over the Internet. The Server Name Indication (SNI) field in the TLS handshake, which goes in plain text, ensures that the traffic from the replay server appears to network middle-boxes as that coming from its actual server. We validated that appropriate SNIs result in the correct classification of services using a commercial traffic shaper. FairNet uses two novel algorithms based on application-level throughput and connection status to detect traffic discrimination. We also validated the methodologys effectiveness by collecting network logs through mobile apps over the live Internet and analyzing them.

Cybersecurity: a tool for curbing examination breaches and improvement of the quality of large-scale educational assessments

ABSTRACT This study investigated how cybersecurity can be integrated to curb examination breaches among large-scale educational assessment bodies in Nigeria. Descriptive research designed guided the study with 1067 participants drawn through multistage sampling procedure. Cybersecurity and examination breaches on large-scale educational assessment questionnaire (CEBLSEA-Q) was used for data collection. The internal consistency reliability index of the instrument was evaluated to be .78 using Cronbach alpha method. The findings of the study showed that hacking of websites, colluding via social media (WhatsApp, Facebook, Twitter etc.), sending of malicious/phishing links, using man-in-the-middle (MITM) attack are some of the cyberattacks on large-scale educational assessments. The proportion of examination breaches experienced by the various examination bodies was significantly different with WAEC being the highest, followed by NECO, JAMB, and NABTEB. Cybersecurity measures such as cloud computing, securing domain name server (DNS), encrypting computers and applications containing assessment database, cybersecurity awareness, among others could curb cyberspace aided examination breaches on educational assessments. Cybersecurity measures should be adopted by large-scale educational agencies in order to curb examination breaches that are aided through the cyberspace.

A targeted search for FRB counterparts with Konus-Wind

ABSTRACT We present results of the search for hard X-ray/soft gamma-ray emission in coincidence with publicly reported (via Transient Name Server, TNS1) fast radio bursts (FRBs). The search was carried out using continuous Konus-Wind data with 2.944 s time resolution. We perform a targeted search for each individual burst from 581 FRBs, along with a stacking analysis of the bursts from eight repeating sources in our sample and a separate stacking analysis of the bursts from the non-repeating FRBs. We find no significant associations in either case. We report upper bounds on the hard X-ray (20–1500 keV) flux assuming four spectral models, which generally describe spectra of short and long gamma-ray bursts (GRBs), magnetar giant flares, and the short burst, coincident with FRB 200428 from a Galactic magnetar. Depending on the spectral model, our upper bounds are in the range of (0.1–2) × 10−6 erg cm−2. For 18 FRBs with known distances, we present upper bounds on the isotropic equivalent energy release and peak luminosity. For the nearest FRB 200120E, we derive the most stringent upper bounds of Eiso ≤ 2.0 × 1044 erg and Liso ≤ 1.2 × 1044 erg s−1. Furthermore, we report lower bounds on radio-to-gamma-ray fluence ratio Eradio/Eiso ≥ 10−11–10−9 and compare our results with previously reported searches and theoretical predictions for high-energy counterparts to FRBs.

Enterprise DNS Asset Mapping and Cyber-Health Tracking via Passive Traffic Analysis

The Domain Name System (DNS) is a critical service that enables domain names to be converted to IP addresses (or vice versa); consequently, it is generally permitted through enterprise security systems (e.g., firewalls) with little restriction. This has exposed organizational networks to DDoS, exfiltration, and reflection attacks, inflicting significant financial and reputational damage. Large organizations with loosely federated IT departments (e.g., Universities and Research Institutes) often do not even fully aware of all their DNS assets and vulnerabilities, let alone the attack surface they expose to the outside world. In this paper, we address the "DNS blind spot" by developing methods to passively analyze live DNS traffic, identify organizational DNS assets, and monitor their health on a continuous basis. Our contributions are threefold. First, we perform a comprehensive analysis of all DNS traffic in two large organizations (a University Campus and a Government Research Institute) for over a month, and identify key behavioral profiles for various asset types such as recursive resolvers, authoritative name servers, and mixed DNS servers. Second, we develop an unsupervised clustering method that classifies enterprise DNS assets using the behavioral attributes identified, and demonstrate that our method successfully classifies over 100 DNS assets across the two organizations. Third, our method continuously tracks various health metrics across the organizational DNS assets and identifies several instances of improper configuration, data exfiltration, DDoS, and reflection attacks. We believe the passive analysis methods in this paper can help enterprises monitor organizational DNS health in an automated and risk-free manner.

Configuration anormaly detection and resolution risk assessment of authoritative domain name server

Authoritative domain name servers (referred to as authoritative servers) play a critical role in the Domain Name System (DNS) by resolving domain names to specific IP or CNAME records, ensuring seamless internet access. However, misconfigurations in authoritative servers can introduce risks to domain name resolution. This paper proposes a comprehensive approach to analyze and evaluate the configuration risks of authoritative servers. We develop a tool called “AuthDetect” to detect configuration anomalies in authoritative servers, and leveraging this tool, we conduct anomaly detection and analyze resolution risks from three perspectives: resolution latency, content, and reliability. Our evaluation indicates that 90% of the domains have a favorable overall resolution risk (below 0.13), but varying levels of risks exist: (1) 60% face resolution latency risk, (2) only 8.33% of domain names exhibit content risk, and (3) almost all domain names (99.8%) experience resolution reliability risk, primarily due to inadequate server configuration. These findings offer valuable data support for domain name managers, providing insights into the current configuration status of authoritative servers and contributing to maintaining a healthy and stable DNS system operation.