Detecting Abuse of Abandoned Internet Resources Tim Schmidt - - PowerPoint PPT Presentation

▶
detecting abuse of abandoned internet resources
SMART_READER_LITE
LIVE PREVIEW

Detecting Abuse of Abandoned Internet Resources Tim Schmidt - - PowerPoint PPT Presentation

Feb 05, 2023 256 likes •557 views

Chair for Network Architectures and Services Technische Universit at M unchen Detecting Abuse of Abandoned Internet Resources Tim Schmidt Betreuer: Dipl. Inf. Johann Schlamp, Dipl. Ing. Quirin Scheitle 12.08.2015 Chair for Network

slide-1
SLIDE 1

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

Detecting Abuse of Abandoned Internet Resources

Tim Schmidt

Betreuer: Dipl. Inf. Johann Schlamp, Dipl. Ing. Quirin Scheitle

12.08.2015 Chair for Network Architectures and Services Department of Informatics Technische Universit¨ at M¨ unchen

Tim Schmidt – Detecting Abuse of Abandoned Internet Resources 1

slide-2
SLIDE 2

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

Overview

Basics Existing Work RIR Models Timeline & Outlook

Tim Schmidt – Detecting Abuse of Abandoned Internet Resources 2

slide-3
SLIDE 3

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

Overview

Basics Existing Work RIR Models Timeline & Outlook

Tim Schmidt – Detecting Abuse of Abandoned Internet Resources 3

slide-4
SLIDE 4

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

Regional Internet Registry (RIR) Manages and assigns Internet Number Resources such as:

◮ IP Address spaces (IPv4 and v6) ◮ AS Numbers

Note There are five Regional Internet Registries, compare next slide.

Tim Schmidt – Detecting Abuse of Abandoned Internet Resources 4

slide-5
SLIDE 5

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

Areas of Responsibility

Figure: RIR regions1

1Source: nro.net

Tim Schmidt – Detecting Abuse of Abandoned Internet Resources 5

slide-6
SLIDE 6

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

Overview

Basics Existing Work RIR Models Timeline & Outlook

Tim Schmidt – Detecting Abuse of Abandoned Internet Resources 6

slide-7
SLIDE 7

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

Existing Work Note My work is based on Christian Eckert’s master’s thesis: ”Ein Fruehwarnsystem fuer AS Hijacking” (TUM, 2013) → C. Eckert implemented a parser for RIPE data (dumpfiles) → My implementation uses parts of his code → The TUM Chair for Network Architectures and Services provides dumpfiles for every RIR, updated daily.

Tim Schmidt – Detecting Abuse of Abandoned Internet Resources 7

slide-8
SLIDE 8

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

Detecting Abandoned Resources

  • 1. Domain information
  • 2. Maintainer relations
  • 3. Organisation relations
  • 4. No. of relations

Tim Schmidt – Detecting Abuse of Abandoned Internet Resources 8

slide-9
SLIDE 9

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

Detecting Abandoned Resources

  • 1. Domain information → domain expired?
  • 2. Maintainer relations
  • 3. Organisation relations
  • 4. No. of relations

Tim Schmidt – Detecting Abuse of Abandoned Internet Resources 9

slide-10
SLIDE 10

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

Detecting Abandoned Resources

  • 1. Domain information → domain expired?
  • 2. Maintainer relations → maintainer nonexistent / inactive?
  • 3. Organisation relations
  • 4. No. of relations

Tim Schmidt – Detecting Abuse of Abandoned Internet Resources 10

slide-11
SLIDE 11

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

Detecting Abandoned Resources

  • 1. Domain information → domain expired?
  • 2. Maintainer relations → maintainer nonexistent / inactive?
  • 3. Organisation relations → org. nonexistent / inactive?
  • 4. No. of relations

Tim Schmidt – Detecting Abuse of Abandoned Internet Resources 11

slide-12
SLIDE 12

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

Detecting Abandoned Resources

  • 1. Domain information → domain expired?
  • 2. Maintainer relations → maintainer nonexistent / inactive?
  • 3. Organisation relations → org. nonexistent / inactive?
  • 4. No. of relations → low degree of connectivity?

Tim Schmidt – Detecting Abuse of Abandoned Internet Resources 12

slide-13
SLIDE 13

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

Detecting Abandoned Resources

  • 1. Domain information → domain expired?
  • 2. Maintainer relations → maintainer nonexistent / inactive?
  • 3. Organisation relations → org. nonexistent / inactive?
  • 4. No. of relations → low degree of connectivity?

Scoring-System Based on those aspects determine a score for possibility that resource is abandoned and or abused / hijacked.

Tim Schmidt – Detecting Abuse of Abandoned Internet Resources 13

slide-14
SLIDE 14

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

Dumpfile Example: Objects (1)

Tim Schmidt – Detecting Abuse of Abandoned Internet Resources 14

slide-15
SLIDE 15

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

Dumpfile Example: Objects (2)

Tim Schmidt – Detecting Abuse of Abandoned Internet Resources 15

slide-16
SLIDE 16

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

Dumpfile Example: Objects (3)

Tim Schmidt – Detecting Abuse of Abandoned Internet Resources 16

slide-17
SLIDE 17

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

Tasks

  • 1. Analyze and understand the structure of the dump data for

all RIRs

  • 2. Map data from the other RIRs to generic data model

(based on RIPE)

  • 3. Adapt existing RIPE-parser code to the four remaining

RIRs

  • 4. Use the same database format for compatibility: neo4j
  • 5. Evaluate Data based on existing model for abuse detection

Tim Schmidt – Detecting Abuse of Abandoned Internet Resources 17

slide-18
SLIDE 18

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

Overview

Basics Existing Work RIR Models Timeline & Outlook

Tim Schmidt – Detecting Abuse of Abandoned Internet Resources 18

slide-19
SLIDE 19

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

RIPE

Tim Schmidt – Detecting Abuse of Abandoned Internet Resources 19

slide-20
SLIDE 20

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

APNIC

Tim Schmidt – Detecting Abuse of Abandoned Internet Resources 20

slide-21
SLIDE 21

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

AFRINIC

Tim Schmidt – Detecting Abuse of Abandoned Internet Resources 21

slide-22
SLIDE 22

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

LACNIC

Tim Schmidt – Detecting Abuse of Abandoned Internet Resources 22

slide-23
SLIDE 23

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

ARIN

Tim Schmidt – Detecting Abuse of Abandoned Internet Resources 23

slide-24
SLIDE 24

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

Generic Model

Tim Schmidt – Detecting Abuse of Abandoned Internet Resources 24

slide-25
SLIDE 25

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

RIR Object types

Figure: Number of object types for all RIRs

Tim Schmidt – Detecting Abuse of Abandoned Internet Resources 25

slide-26
SLIDE 26

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

Overview

Basics Existing Work RIR Models Timeline & Outlook

Tim Schmidt – Detecting Abuse of Abandoned Internet Resources 26

slide-27
SLIDE 27

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

Timeline

Figure: Timeline

Tim Schmidt – Detecting Abuse of Abandoned Internet Resources 27

slide-28
SLIDE 28

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

Outlook What needs to be done: → Feed data to neo4j database Parsed data is already in correct format! → Implement cronjobs for daily parsing / updates → Evaluation

Tim Schmidt – Detecting Abuse of Abandoned Internet Resources 28

slide-29
SLIDE 29

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

Any questions? Feel free to ask!

Tim Schmidt – Detecting Abuse of Abandoned Internet Resources 29