Increasing DNS Security and Stability through a Control Plane for Top-Level Domain Operators

摘要

We present a control plane for operators of top-level domains (TLDs) in the DNS, such as “.org” and “.nl,” that enables them to increase the security and stability of their TLD by taking on the role of a threat intelligence provider. Our control plane is a novel system that extends a TLD operator's traditional services and detects potential threats in the TLD by continuously analyzing the TLD operator's two key datasets: the typically large amounts of DNS traffic that it handles and its database of registered domain names. The control plane shares information on discovered threats with other players in the TLD's ecosystem and can also use it to dynamically scale the TLD operator's DNS infrastructure. The control plane builds on a set of open source modules that we have developed on top of a Hadoop-based data storage cluster. These enable, for example, TLD operators to run and develop threat detectors and to easily import their DNS traffic into the control plane. Our control plane uses policies to protect the privacy of TLD users and is based on our operational experience of running .nl TLD (Netherlands), which we are also using as the use case for our implementation.