<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Nov 12, 2019, at 3:39 PM, Michele Neylon - Blacknight <<a href="mailto:michele@blacknight.com" class="">michele@blacknight.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" class="">Samaneh<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" class="">Do you have slides from the DAAR session?<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" class="">Regards<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" class="">Michele<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" class=""><o:p class=""> </o:p></span></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="" class="">--<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="" class="">Mr Michele Neylon<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="" class="">Blacknight Solutions<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="" class="">Hosting, Colocation & Domains<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="" class=""><a href="https://www.blacknight.com/" style="color: blue; text-decoration: underline;" class="">https://www.blacknight.com/</a><o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="" class=""><a href="https://blacknight.blog/" style="color: blue; text-decoration: underline;" class="">https://blacknight.blog/</a><o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="" class="">Intl. +353 (0) 59 9183072<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="" class="">Direct Dial: +353 (0)59 9183090<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="" class="">Personal blog:<span class="Apple-converted-space"> </span><a href="https://michele.blog/" style="color: blue; text-decoration: underline;" class="">https://michele.blog/</a><o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="" class="">Some thoughts:<span class="Apple-converted-space"> </span><a href="https://ceo.hosting/" style="color: blue; text-decoration: underline;" class="">https://ceo.hosting/</a><o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="" class="">-------------------------------<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="" class="">Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" style="" class="">Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845</span><span lang="EN-GB" class=""><o:p class=""></o:p></span></div></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-GB" class=""><o:p class=""> </o:p></span></div><div style="border-style: solid none none; border-top-width: 1pt; border-top-color: rgb(181, 196, 223); padding: 3pt 0cm 0cm;" class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><b class=""><span style="font-size: 12pt;" class="">From:<span class="Apple-converted-space"> </span></span></b><span style="font-size: 12pt;" class="">DNS-Abuse-Measurements <<a href="mailto:dns-abuse-measurements-bounces@icann.org" style="color: blue; text-decoration: underline;" class="">dns-abuse-measurements-bounces@icann.org</a>> on behalf of Samaneh Tajalizadehkhoob via DNS-Abuse-Measurements <<a href="mailto:dns-abuse-measurements@icann.org" style="color: blue; text-decoration: underline;" class="">dns-abuse-measurements@icann.org</a>><br class=""><b class="">Reply to:<span class="Apple-converted-space"> </span></b>Samaneh Tajalizadehkhoob <<a href="mailto:samaneh.tajali@icann.org" style="color: blue; text-decoration: underline;" class="">samaneh.tajali@icann.org</a>><br class=""><b class="">Date:<span class="Apple-converted-space"> </span></b>Tuesday 12 November 2019 at 12:00<br class=""><b class="">To:<span class="Apple-converted-space"> </span></b>"<a href="mailto:dns-abuse-measurements@icann.org" class="">dns-abuse-measurements@icann.org</a>" <<a href="mailto:dns-abuse-measurements@icann.org" class="">dns-abuse-measurements@icann.org</a>><br class=""><b class="">Cc:<span class="Apple-converted-space"> </span></b>David Conrad <<a href="mailto:david.conrad@icann.org" class="">david.conrad@icann.org</a>><br class=""><b class="">Subject:<span class="Apple-converted-space"> </span></b>[DNS-Abuse-Measurements] Highlights of ICANN 66 DAAR session<o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-family: "Helvetica Neue";" class="">Again we welcome members of the DNS Abuse measurement mailing list.<o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-family: "Helvetica Neue";" class="">We have created this mailing list as a part of DAAR improvement process and followed by requests from the community for more transparency on the DAAR progress. The goal of the list is to facilitate DNS Abuse/security measurement discussions including but not limited to those related to DAAR.<o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-family: "Helvetica Neue";" class=""><o:p class=""> </o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-family: "Helvetica Neue";" class=""><o:p class=""> </o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-family: "Helvetica Neue";" class="">To start the discussion as the DAAR project owner and the mailing list facilitator, hereby I draft a couple of highlights of our DAAR session at ICANN66 in Montreal for those that were not able to attend the session:<o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-family: "Helvetica Neue";" class=""><o:p class=""> </o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-family: "Helvetica Neue";" class="">The feedback we have received up to now regarding the DAAR improvement process<o:p class=""></o:p></span></div></div><ul type="disc" style="margin-bottom: 0cm; margin-top: 0cm;" class=""><li class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; font-stretch: normal;"><span style="font-family: "Helvetica Neue";" class="">Requests for more transparency on DAAR progress<o:p class=""></o:p></span></li><li class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; font-stretch: normal;"><span style="font-family: "Helvetica Neue";" class="">Re-aggregating the DAAR data<span class="Apple-converted-space"> </span><o:p class=""></o:p></span></li><li class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; font-stretch: normal;"><span style="font-family: "Helvetica Neue";" class="">Adding threat domain time-to-live data<o:p class=""></o:p></span></li><li class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; font-stretch: normal;"><span style="font-family: "Helvetica Neue";" class="">Adding ccTLDs to DAAR<span class="Apple-converted-space"> </span><o:p class=""></o:p></span></li><li class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; font-stretch: normal;"><span style="font-family: "Helvetica Neue";" class="">Adding registrar metrics to DAAR<span class="Apple-converted-space"> </span><o:p class=""></o:p></span></li><li class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; font-stretch: normal;"><span style="font-family: "Helvetica Neue";" class="">Publishing DAAR detailed data<span class="Apple-converted-space"> </span><o:p class=""></o:p></span></li><li class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; font-stretch: normal;"><span style="font-family: "Helvetica Neue";" class="">Distinguishing between maliciously registered domains and compromised one<o:p class=""></o:p></span></li><li class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; font-stretch: normal;"><span style="font-family: "Helvetica Neue";" class="">Better articulation of DAAR’s goal in monthly reports and documentation<o:p class=""></o:p></span></li></ul><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-family: "Helvetica Neue";" class=""><o:p class=""> </o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-family: "Helvetica Neue";" class="">The changes we have made<o:p class=""></o:p></span></div></div><ul type="disc" style="margin-bottom: 0cm; margin-top: 0cm;" class=""><li class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; font-stretch: normal;"><span style="font-family: "Helvetica Neue";" class="">Sharing DAAR data with registries via MOSAPI: Now each gTLD registry can view their own reputation data per security threat type via MOSAPI. For more information please contact<a href="mailto:globalSupport@icann.org" style="color: blue; text-decoration: underline;" class=""><span style="color: rgb(18, 79, 146);" class="">globalSupport@icann.org</span></a>.<o:p class=""></o:p></span></li><li class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; font-stretch: normal;"><span style="font-family: "Helvetica Neue";" class="">Re-Aggregating DAAR statistics including those in the monthly report from a snapshot metric (measures for a specific day of the month) to a monthly median metric.<o:p class=""></o:p></span></li><li class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; font-stretch: normal;"><span style="font-family: "Helvetica Neue";" class="">We used<span class="Apple-converted-space"> </span><b class="">Restriction Type</b><span class="Apple-converted-space"> </span>as another metric to cut the data, on top of the TLD Type (based on our definition legacy versus new) that we already had. Plotting the data demonstrated that almost all threat types are populated with security threat domains within<span class="Apple-converted-space"> </span><b class="">generic</b>gTLDs. This is while certain security threat types such as Botnet C&C have 25% of their abuse (10000 domains) located in<span class="Apple-converted-space"> </span><b class="">generic restricted<span class="Apple-converted-space"> </span></b>gTLDs and Spam has around 5% of their total security threat domains (equal to 25000 domains) located in<span class="Apple-converted-space"> </span><b class="">Brand</b><span class="Apple-converted-space"> </span>gTLDs.<span class="Apple-converted-space"> </span><o:p class=""></o:p></span></li><li class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; font-stretch: normal;"><span style="font-family: "Helvetica Neue";" class="">Carried out an inferential analysis of potential relationships with abuse drivers. For instance, showed that “Size of a zone file” can be an<span class="Apple-converted-space"> </span><b class="">explanatory factor</b><span class="Apple-converted-space"> </span>for the concentrations of security threat domains but it can also be an indicator of<span class="Apple-converted-space"> </span><b class="">attack surface size<span class="Apple-converted-space"> </span></b>for attackers.<span class="Apple-converted-space"> </span><o:p class=""></o:p></span></li><li class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; font-stretch: normal;"><span style="font-family: "Helvetica Neue";" class="">Using a GLM statistical model we modeled all the security threat drivers that we could collect data on and demonstrated that size of a TLD, type of a TLD and restriction type of a TLD plays a statistically significant role in explaining security threat concentrations.<span class="Apple-converted-space"> </span><o:p class=""></o:p></span></li><li class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; font-stretch: normal;"><span style="font-family: "Helvetica Neue";" class="">To bring more transparency on the DAAR project and its progress we made the<span class="Apple-converted-space"> </span><a href="mailto:dns-abuse-measurements@icann.org" style="color: blue; text-decoration: underline;" class="">dns-abuse-measurements@icann.org</a><span class="Apple-converted-space"> </span>mailing list<o:p class=""></o:p></span></li><li class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; font-stretch: normal;"><span style="font-family: "Helvetica Neue";" class="">Upon many requests from ccTLDs, as of the ICANN66 meeting ccTLDs are able to provide their zone files for inclusion in DAAR. This means that they will be able to pull their own aggregated DAAR data via MOSAPI. The process is simple, ccTLDs need to send an email to<span class="Apple-converted-space"> </span><a href="mailto:globalSupport@icann.org" style="color: blue; text-decoration: underline;" class=""><span style="color: rgb(18, 79, 146);" class="">globalSupport@icann.org</span></a><span class="Apple-converted-space"> </span>with the subject: ccTLDs access to the DAAR data. We encourage those parties interested to come forward and participate.<o:p class=""></o:p></span></li></ul><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-family: "Helvetica Neue";" class=""><br class=""><br class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-family: "Helvetica Neue";" class="">Moving forward we intend to work on<o:p class=""></o:p></span></div></div><ul type="disc" style="margin-bottom: 0cm; margin-top: 0cm;" class=""><ul type="disc" style="margin-bottom: 0cm; margin-top: 0cm;" class=""><li class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; font-stretch: normal;"><span style="font-family: "Helvetica Neue";" class="">DAAR v2<span class="Apple-converted-space"> </span><o:p class=""></o:p></span></li><li class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; font-stretch: normal;"><span style="font-family: "Helvetica Neue";" class="">Incorporating more Reputation Black/Block lists (RBLs)<o:p class=""></o:p></span></li><li class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; font-stretch: normal;"><span style="font-family: "Helvetica Neue";" class="">Developing RBL evaluation cycle<span class="Apple-converted-space"> </span><o:p class=""></o:p></span></li><li class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; font-stretch: normal;"><span style="font-family: "Helvetica Neue";" class="">Developing Registrar metrics <span class="Apple-converted-space"> </span><o:p class=""></o:p></span></li><li class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; font-stretch: normal;"><span style="font-family: "Helvetica Neue";" class="">Reviewing other factors that drive security threat within registrars and registries<o:p class=""></o:p></span></li></ul></ul><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Cheers,<o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Samaneh Tajalizadehkhoob, PhD<o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Lead SSR specialist<o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">ICANN Office of CTO </div></div></div></div></blockquote></div><br class=""></div></body></html>