[NCAP-Discuss] Data / CI effectiveness (was Re: why enhanced controlled interruption - not legal)

[Casey Deccio]

Hi Danny and all,

> On Feb 25, 2022, at 1:32 PM, Danny McPherson <danny at tcb.net> wrote:
> 
> I'm saying that unless we can prove CI is effective (which I have seen no data to support)

I have been half-watching this conversation until now, but this caught my eye and is something I can speak to, as the data surrounding CI is something that I am currently studying.

I am analyzing various data sets and performing outreach to better understand the effectiveness of CI, as has been implemented since August 2014.  At this point I don't have any solid conclusions, one way or the other, but I am making some progress and hope to have some better answers in the next month or so.  That being said, here is a (very) brief preview of some of the things I am seeing.  

Please note that this is all somewhat preliminary, and there is more detail that is lacking from in this brief description but will be forthcoming.

new gTLDs - the 885 gTLDs delegated between Aug 2014 and June 2021.
suffix - a DNS suffix applied to computer system (e.g., foo.com), observed during the CI period (first 100 days of delegation).  A total of 2300 were identified using Farsight's DNSDB, from approximately 166 of the new gTLDs (again, there are some implementation details missing here, but this is a pretty good estimate).  Note that none of these 2300 suffixes *is* a new gTLD itself, but is rather a proper subdomain.

After analyzing the 2014, 2015, 2016, 2017, and 2021 DITL data (2018 through 2020 are in process), I have seen the following trends:

Year		Obs		Del		Pct1		Del/Obs	Pct
2014	1858				
2015	1806	1037	79%		743		72%
2016	1610	1808	70%		1207	67%
2017	1508	2018	66%		1248	62%
2021	1283	2300	56%		1283	56%

Obs - suffixes observed in DITL queries
Del - suffixes for which TLD is delegated
Pct1 - Percent of overall suffixes observed
Pct2 - Percent of suffixes observed for which TLD was delegated

Here is a view from the perspective of TLDs for which suffixes were observed:

Year		Del	Obs	Pct	
2015	60	46	77%
2016	138	103	75%
2017	191	139	73%
2021	200	129	65%

Obs - TLDs for which suffixes were observed in DITL queries
Del - TLDs delegated
Pct - Percent of TLDs for which suffixes were observed

Note again that Pct is clearly decreasing over the years.

Finally:

		qnames	IPs		ASNs
2015    	16.0 	16.0  	7.0
2016   	18.0 	18.0  	7.0
2017    	12.0 	13.0  	6.0
2021    	10.0 	16.0  	5.0

These are the 75th percentile values associated with suffixes (with delegated TLDs)  in each of the years:
qnames - number of qnames observed with that suffix (75th percentile)
IPs - number of IP addresses querying for that suffix (75th percentile)
ASNs - number of ASNs from queries for that suffix originated (75th percentile)

This one is a little trickier because new suffixes are introduced each year with the delegation of their corresponding TLDs.  Nonetheless, there is an overall decrease here, even if it is not quite as dramatic.

Again, analysis is still underway, so take this for what it's worth.

Casey
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mm.icann.org/pipermail/ncap-discuss/attachments/20220225/16162041/attachment.html>