IP anycast is widely used for root and TLD DNS servers to reduce latency. DNS operators need to perform measurements to understand and improve their service quality. Although it is vital to measure the effect of IP anycast, the measurement requires enough worldwide measurement points to send queries. In this paper, we try a more manageable approach, i.e., analyzing the existing capture data to reveal the response delays between resolvers and authoritative DNS servers. There are two packet capture datasets, the DITL and JP datasets. The DITL dataset is collected by Root server operators and maintained by DNS-OARC. The JP dataset is collected for JP TLD operations. Specifically, we extracted communication delay information from TCP session data in these datasets.Our analysis that uses multiple datasets, i.e., DITL and JP datasets, reveals: 1) Approximately 30% of IPv4 addresses seen at the M-Root & JP DNS server have RTT information and come from over 200 countries. 2) JP DNS servers offer RTT of less than 20ms for 80% of queries from Japan, and RTT of less than 100ms for 80% of queries from outside of Japan. 3) The newly installed M-root Brisbane node offers shorter RTTs in Australia.

Although the domain name system (DNS) is a critical infrastructure of the Internet, accurate DNS configuration is difficult. An inaccurate DNS configuration in the name servers causes failures in name resolution and even unnecessary traffic. Recently, DNS service providers have been gaining attention because they can achieve stable DNS operation without struggling with their DNS configurations. This trend is expected to be strong because using DNS service providers not only involves ease of operation but is also effective in avoiding inaccurate DNS configurations. In this study, we evaluate the current use of DNS service providers and their effectiveness in avoiding inaccurate DNS configurations.

Abuse of the Internet (e.g., spam mailing, phishing, and other antisocial behaviors) is increasing. Blocking such abuses with blacklists is used as a typical countermeasure. A blacklist contains malicious hosts on the Internet reputed to send spam mail, employ phishing, and engage in other antisocial behaviors. By retrieving the blacklists each time when users receive emails, users can reject spam mails. However, it is difficult to keep up with the new malicious hosts created every day, so research is required to maintain the blacklist. In this study, we propose a classification method whose recall rate (97.3%) is higher than that of the best single public blacklist (48.9%). Cardinality analysis, which identifies the access pattern of multiple clients to various domain names, is the main technique of the proposed method. We explain the method together with the results of experiments use 26M domain name system query-response data.

In 2020, the COVID-19 pandemic is causing significant problems for our society. Although contact tracing is an essential countermeasure for minimizing exposure, its applications are not widely used in Japan. We have developed a Wi-fi based contact tracing system for use in our campus network to protect students and staff. Although the area covered by Wi-fi technology is too wide to accurately analyze contacts, it can still be used for comparative analysis. We conducted preliminary experiments as an example to compare the effects of countermeasures. Our results show that by making 30% of classrooms safe, we can reduce the number of potential exposures by over 90%. This paper summarizes 1) the system design to acquire necessary information while maintaining the privacy of students, and 2) the results of preliminary experiments that compare the effect of countermeasures.

Content Delivery Networks (CDN) are regarded as important internet infrastructure that supports business on the Internet. Network latency has been identified as an important metric to improve the quality of service (QoS) of CDNs. Given the limitations to response times because of the geographic distance between servers and end-users, CDN providers have developed architectures such as Global Server Load Balancing (GSLB) and IP Anycast to realize fast responses. This study investigates how GSLB and IP Anycast contribute towards improving QoS from the users' perspective. User traffic in the campus network was analyzed and it was found that: 1) 88% of the traffic reaps the benefits of well operated internet services, i.e., they have a Round-Trip Time (RTT) of less than 100 milliseconds. 2) Although GSLB is still the primary architecture for realizing fast responses, IP Anycast supports 5.8% of the traffic.

The Domain Name System (DNS) is a key part of the infrastructure of the Internet. Recent discussions have centered on the removal of the shared DNS resolver and the use of a local full-service resolver instead. From the viewpoint of the cache mechanism, these discussions involve removing the shared DNS cache from the Internet. Although the removal of unnecessary parts from a total system tends to simplify the system, such a large configuration change in the system would need to be be carefully analyzed before its actual deployment. This paper presents our analysis of the effect of a shared DNS resolver based on the campus network traffic. Our findings were as follows: 1) this removal can be expected to amplify the DNS traffic by about 3.3 times, 2) the amplification ratio on the root DNS is much higher (about 10.9 times), and 3) removal of all caching systems from the Internet is likely to amplify the DNS traffic by approximately 12.1 times. Thus, the above-mentioned shared DNS resolver removal should not be considered. Our data analysis also revealed: 4) an increase in the number of clients that do not have a local DNS cache and generate repeated queries at short intervals (less than 1 min). 5) Since the amount of traffic from such clients is not small (about 95.0% of total DNS traffic), the deployment of a local cache itself is feasible.

To resist the growth of abnormal traffic such as P2P, DDoS and Internet worms, this paper discusses a circuit design to realize real-time abnormal traffic detection from broadband networks. Real-time counting of cardinality is the key of the circuit. Although our previous study showed the effectiveness of cardinality counting to detect various abnormal traffic, the slowness of DRAM access prevented us from actually deploying the cardinality counting into backbone network. This paper shows that the use of self-timed pipeline circuit can realize a cardinality counting circuit that can handle up-to 100 Gbps networks by hiding the DRAM access latency.