SCI: ITR - (NHS + EVS) - (dmc + SIM) : Improving the Integrity of Domain Name System (DNS) Monitoring and Protection

University Of California-San Diego, La Jolla CA

Investigators

Abstract

This proposal outlines an effort to monitor and study one of the Internet's most important elements of infrastructure whose failure would render the Internet unusable: the Domain Name System (DNS). The CAIDA measurement group from SDSC is teaming with the Internet Systems Consortium (ISC), maintainers of BIND and the F-root servers of DNS, to carry out a series of tasks. These tasks include: establish a long-term measurement infrastructure with supporting software tools to measure and understand behavior of the root DNS system; study a series of research questions on DNS such as the effects of anycast for a given root and/or client, anomaly identification in DNS traffic; characterizing traffic reaching the root name servers; understanding spurious RFC 1918 (private address space) traffic; how to auto-identify one-way queries; the traffic effects of DNSSEC; DNS resolver behavior in the context of global DNS; and characterizing root server performance and connectivity. The sum of this work, and the associated outreach activities, are intended to go a long way in the community hardening and securing DNS over time. Intellectual Merit and Broader Impact: The intellectual merit of this proposal lies in how it addresses National and Homeland Security (NHS) related recommendations to develop a 'cyberspace network operations center (NOC)' as well as its long-term mission to provide data needed to support DNS research that has relevance to the real Internet and how it support economic prosperity and vibrant civil society (ECS). The proposed work has broad impact on all three national priority areas in the ITR solicitation: (1) It advances the integrity of the field of Internet research by providing real data from core Internet components that are otherwise not amenable to measurement or modeling. (2) A global economy dependent on the Internet is a global economy dependent on the Domain Name Service working properly and securely. Protecting oneself against vulnerabilities in the DNS infrastructure will reduce national as well as global risk. (3) The DNS-OARC will enhance national and international security by providing a collaborative knowledge environment in which to establish and refine mechanisms for emergency response, and developing new technology for prevention, attribution and remediation of malicious or otherwise misbehaving agents affecting the DNS.