Visualization of DNS Dependencies and More Casey Deccio Brigham - PowerPoint PPT Presentation

Visualization of DNS Dependencies and More Casey Deccio Brigham Young University

Graph-Based Visualization as a Tool • Visual Awareness • Humans see trends or more clearly identify problems • Data Structures • Graphical data structures can be used for programmatic analysis

What Is Included? Basic Components • Direct Relationships foo.com • Dependency • Influence • Weight • Groupings • Boundaries Inferences • Common Ancestry • Transitive Relationships

Example: Resolution Dependencies/Influence www.foo.com • Nodes = domain names • Edges = dependencies www.bar.com foo.com • Child to parent • Alias to target ns.bar.com bar.com • Zone to NS targets com ns.baz.net baz.net net .

Quantifying Influence with Weights www.foo.com • Follow edges on path using weights as 1.0 1.0 (alias) probability (parent) www.bar.com foo.com P {c,s} ( ns.bar.com )0.5 1.0 (NS) 1.0 (parent) 1.0 (parent) ns.bar.com (parent) bar.com 0.5 (NS) com 1.0 (parent) ns.baz.net 1.0 1.0 (parent) baz.net (parent) 1.0 (parent) 1.0 (parent) net .

Defining Boundaries www.foo.com • Zone Boundaries 1.0 1.0 (alias) (parent) • Administrative Boundaries www.bar.com foo.com • Direct Configuration Boundaries P 0.5 1.0 (NS) 1.0 (parent) 1.0 (parent) ns.bar.com (parent) bar.com 0.5 (NS) com 1.0 (parent) ns.baz.net 1.0 1.0 (parent) baz.net (parent) 1.0 (parent) 1.0 (parent) net .

2010 Results • Under normal circumstances: • Nearly all zones rely on fewer than 20 other zones • 80% of zones have no third-party influence

Connecting Multiple Types of Nodes • Direct server dependencies: • Zone-to-server: Dependency of bar.com zone on server whose name has in-bailiwick glue record 192.0.2.2 me.baz.net • Name-to-server: Dependency of name on address 192.0.2.3

Connecting Multiple Types of Nodes • DNSSEC Dependencies

Other Types of Nodes / Relationships • Geographic region • ASN • IP Reputation Category

Getting the Most Mileage / How does it scale? • Meaningful use of symbols, styles, and labels • Emphasize the most important distinctions • Aggregation • Must be based on basic relationships • Both quantitative and qualitative analysis