Manuscript Prep Instructions - Core Security

DISPOSABLE DOMAINSYizheng Chen, Manos Antonakakis, Wenke LeeGeorgia Institute of TechnologyAbstractIn recent years DNS has been increasinglyleveraged to build and scale highly reliablenetwork infrastructures. In this paper, we willintroduce and analyze a new class ofdomains, which we refer to as disposabledomains. Disposable domains appear to beheavily employed by common Internetservices (i.e., Search Engines, SocialNetworks, Online Trackers etc.), and theyseem to be automatically generated. They arecharacterized by a “one-time use” pattern,and appear to be used as a way of“signaling” via DNS. While this is yetanother “creative” use of the DNS to enablenew Internet applications and efficient scalingof services, little do we know about the sizeand DNS caching properties of this family ofdomains.To shed light on the pervasiveness andgrowth of disposable domains, we present astudy of their characteristics based on liveDNS traffic observed at Comcast, in a citythat serves millions of end users. We foundthat disposable domains increased from23.1% to 27.6% in all queried domain names,and from 27.6% to 37.2 % among all resolveddomain names daily, and more than 60% ofall distinct resource records observed daily inmodern DNS traffic are related to disposabledomains. We discuss the possible negativeimplications that disposable domains mayhave on the DNS caching infrastructure,resolvers validating DNSSEC transactions,and passive DNS data collection systems.INTRODUCTIONDomain Name System was originallydesigned for mapping a human-friendlydomain name to a machine-readable IPaddress. Over the years, people have usedDNS in new ways to make their services moreagile and scalable. However, they all hadunanticipated and sometimes negative impactas the following three examples shows.The first example is using DNS to select aContent Delivery Network (CDN) server thatis closest to client. When a CDN sees a DNSrequest for content, it will return a CDNserver IP address that is closest to therequester IP, and with small load at the time.Since what CDN sees is the IP address of theDNS server that user’s machine is configuredto, not the user’s IP address, the effectivenessof such approach depends on how close usersare to their local DNS servers. Researchers [1]have shown that 64% of associations of user’sand the local DNS server’s IP addresses are inthe same Autonomous System. However, only16% of associations are in the same networkaware clusters, from the perspective of BGProutes. The second example is browserprefetching to speed up webpage loadingperformance [2]. When a user is enteringsearch queries, the browser will look upunfinished search queries as possible domainnames and pre-resolve all the domain namesbefore user finishes typing. The design ofprefetching is used for web objects as well, tominimize the delay user perceives whilebrowsing. However, an unanticipated negativeimpact from that is DNS prefetching couldpotentially leak user’s privacy by exposingthe search terms in just the DNS queries. Thelast example is NXDOMAIN redirection fordisplaying commercials. Parked domains areoften redirected to advertisement pages tomonetize existing users for the old domainname. The practice of doing that was called“DNS lie” [3] [4]. It has always beencontroversial of whether ISPs should do that,since advertisement page is not the page usersintend to look for.

Figure 1. Three examples of disposable domain names from eSoft, McAfee, and Google.As the Internet has evolved over the years,more service providers, such as popularsearch engines, social networks, and onlinetrackers, began to use a new class of domainnames, that we call disposable domains.Disposable domains almost seem to be anatural result of people seeking even moreagility and scalability for their Internetservices. Using disposable domains, serviceproviders don’t need to set up any dedicatedinfrastructure for their service, but to simplyoverload DNS with customized protocols. Wewill discuss the properties of this new class ofdomain names, specifically focusing on theiralgorithmically-generated zone structures andtheir low cache hit rates obtained from acluster of recursive DNS resolvers operatedby Comcast, a large north-American ISP.very costly for ISPs in a DNSSEC-enabledrecursive environment. Lastly, disposabledomains increase the storage requirement forpassive DNS data collection systems, andcould potentially degrade database querylatency.This increase in use of disposable domainsmay have unanticipated negative effects onday-to-day DNS operations for large ISPs. Forinstance, a large number of DNS requests fordisposable domains could fill up the cache ofrecursive DNS resolvers. Such an event maycause premature cache evictions of nondisposable domains, which would degradeDNS service for the ISP. In turn, thesepremature evictions may inflate the trafficbetween the DNS resolvers and authoritativename servers, a phenomenon that could beMINING DISPOSABLE DOMAINSIn the rest of the paper, we will first showsome examples of disposable domains anddiscuss their properties. Then we will providesupporting evidence on how disposabledomains are currently used by large serviceproviders. Lastly, we will discuss possiblenegative implications that the growth indisposable domains may have on the DNScaching infrastructure, DNSSEC-validatingresolvers, and passive DNS data collectionsystems.In this section we will define disposabledomain names and we will provide some realworld examples of their use in case studies.Then, we will discuss the prevalence ofdisposable domains. We define disposabledomain names as successfully resolveddomain names that have the followingproperties:

1). Their name strings are automaticallygenerated.2). The median cache hit rate for the resourcerecords of child domain names under a zonethat facilitates disposable domain names islow or close to zero. In other words, theresource records under that particular zone areonly observed once, or a handful of times,when they are in the recursive DNS servers’cache.domains are zero. On the other hand, cache hitrates of non-disposable domains follow acloser to linear cumulative distribution, andthe median cache hit rate would be around40%. In general, resource records ofdisposable domain names are used only onceor up to a few times while they are in therecursive cache, which results in the overalllow cache hit rate distribution for domainsunder disposable zones.Measurement ResultsCase StudiesFigure 1 shows three examples of what wedefine as disposable domain names. TheeSoft (i) domain names are used as a storagecommunication channel that reports CPUload, machine up time, memory usage andswap disk usage. The McAfee [5] (ii) domainnames are used for file reputation queries onbehalf of McAfee’s Global Threat IntelligenceFile reputation Service. This is yet anothercase of using the DNS as an informationstorage communication channel. Lastly,Google’s IPv6 experiment domains [6] (iii)are queried by browsers of selected users thatperform cryptographically signed backgroundrequests after receiving their search results.The background requests record IPv4 andIPv6 addresses, image request latency, andUser-Agent strings.Examining the zone structures from Figure2 shows that 1) disposable domain names tendto have same number of periods (“.”), 2) atcertain places between two periods, the labelsare “random-looking”. The structure propertyreflects how zone operators parse and usedifferent parts of disposable domains fordifferent purposes or transfer differentinformation, by using algorithm-generatedstrings.In addition to zone structural properties,disposable domains typically have very low orsometimes zero cache hit rates. Usually, over90% of cache hit rates from disposableWe built a disposable domain minersystem to automatically mine disposabledomains. The technical details of our systemcan be found in [7]. Over the period of a year,we found 14,488 zones that use disposabledomains, with a confidence of more than90%. Disposable domains are used by variousindustries, including popular websites (e.g.,Google, Microsoft), Anti-Virus companies(e.g., McAfee, Sophos, Sonicwall, Mailshell),DNSBLs (e.g., Spamhaus, countries.nerd.dk),social networks (e.g., Facebook, Myspace),streaming services (e.g., Netflix), P2Pservices (e.g., Skype), cookie trackingservices (e.g., Esomniture, 2o7.net), adnetworks(e.g.,AdSense,BluelinkMarketing), e-commerce business (e.g.,Paypal, ClickBank), etc.Disposable domains are not only widelyused currently, but are also increasingly beingused. For unique domains being queried byclients, the percentage of disposable domainsincreased from 23.1% to 27.6%. Also, of thedaily resolved unique domains the percentage of disposable domains grew from 27.6%to 37.2% over the year of 2011. From trafficduring 11/28/2011 to 12/10/2011, we observethat the number of new disposable domainsseen every day is always high, around 5million to 7 million. However, the number ofnew non-disposable domains dropped from 13million to 1.6 million. So after one day, morethan 50% of new domains seen daily aredisposable, and after 13 days, more than 80%