Re: FW: [gnso-ff-pdp-may08] Introduction and Statement of Interest: Jose Nazario (Arbor Networks)

[Jose Nazario <jose@xxxxxxxxx>]

On Thu, 9 Oct 2008, George Kirikos wrote:

>  Who is going to pay the damages when that occurs?
i agree, and that is always a risk. any block list has these very same 
problems.
bear in mind that our purposes in generating a list of fast flux domains 
was not blockage but identification for further analysis and human 
screened deactivation.
> The fact that you have to have a whitelist demonstrates that the 
> heuristic is weak, as it would otherwise capture innocent sites like 
> Yahoo.com or eBay.com by default. Why would ICANN single out Yahoo.com 
> to be whitelisted, and not any of my company's websites? We each pay 
> ICANN 20 cents/year per domain.
see above; our purposes are just gathering data for a human analyst to 
review, not to automatically shut things down. if we're going to do that 
we have to be even more rigorous in our analysis.
that said, i think whitelisting is a necessary step. any fast flux 
operator can massage the technique to still provide resilient services, 
aka "bulletproof hosting", and look like a legitimate content provider who 
just happens to be spread across multiple ASNs.
> And exactly how many hours/days/weeks did it take for those falsely 
> accused websites to be removed from the blacklist? If they were falsely 
> accused, but didn't report anything to you (i.e. silent victims), would 
> they even appear in your dataset as false positives? And what financial 
> damages were paid to the victimized websites?
again, this isn't a blacklist. but the false posiives get identified 
within 24h and removed almost immediately. no damage was done to any 
"victimized websites" here so no damages were paid. we become aware of the 
problem usually through human follow ups on the data stream itself, not 
the end point (they are unaffected by our approach, so they don't see any 
impact).
-------------------------------------------------------------
jose nazario, ph.d.     <jose@xxxxxxxxx>
security researcher, office of the CTO,  arbor networks
v: (734) 821 1427             http://asert.arbornetworks.com/