For a long time researchers have focused on the binary classification of domain names sent to DNS servers for resolutions to IP addresses. The objective is to identify malicious domains versus legitimate ones to protect networks from attacks. For legitimate domains, an emerging interest is to classify them into content categories to enable DNS servers deployed in an organization to monitor and potentially block the resolution of irrelevant domains. For example, a financial organization wants to flag gaming related domains, and an elementary school wants to block suspicious adult domains. Classifying a domain by just the domain name is a challenging task. Currently, there exist no publicly available datasets that include an extensive mapping of domains to content categories, since this is usually proprietary information. Our focus is three-fold in this work: a) to develop a data collection methodology and create rich labelled datasets that are appropriate for training such predictive models, b) to share the datasets with the research community by making them publicly available, and c) to evaluate and identify appropriate machine learning and deep learning algorithms for this problem domain. We consider two different datasets. The first is created following a SERP (Search Engine Response Page)-mining approach, having a set of content categories as input. The second is an enhancement of the DMOZ dataset that is publicly available, including both domains and category names as input. In addition to the dataset creation input and methodology, these two datasets differ in the content category number and distribution, yielding different results in our analysis. Overall, we observe that the deep learning-based approach carefully considers the key features of the input data and hence outperforms existing traditional machine learning pipelines, achieving 98.37% and 79.29% accuracy on the respective datasets.

While originally not intended for data transfer, the Domain Name System (DNS) is currently used to this end anyway, in a process called DNS tunneling (DNST). Malicious users exploit DNST for data exfiltration from infected machines, posing a critical security threat. We train and evaluate state-of-the-art convolutional neural network, random forest, and ensemble classifiers to detect tunneling in DNS traffic. Finally, we assess the classifiers' performance and robustness by exposing them to one day of real-traffic data.

Domain Generation Algorithms (DGAs) are used by malware to generate a deterministic set of domains, usually by utilizing a pseudo-random seed. A malicious botmaster can establish connections between their command-and-control center (C&C) and any malware-infected machines by registering domains that will be DGA-generated given a specific seed, rendering traditional domain blacklisting ineffective. Given the nature of this threat, the real-time detection of DGA domains based on incoming DNS traffic is highly important. The use of neural network machine learning (ML) models for this task has been well-studied, but there is still substantial room for improvement. In this paper, we propose to use Inductive Venn-Abers predictors (IVAPs) to calibrate the output of existing ML models for DGA classification. The IVAP is a computationally efficient procedure which consistently improves the predictive accuracy of classifiers at the expense of not offering predictions for a small subset of inputs and consuming an additional amount of training data.

We extend Goldberg's multi-server information-theoretic private information retrieval (PIR) with a suite of protocols for privacy-preserving e-commerce. Our first protocol adds support for single-payee tiered pricing, wherein users purchase database records without revealing the indices or prices of those records. Tiered pricing lets the seller set prices based on each user's status within the system; e.g., non-members may pay full price while members may receive a discounted rate. We then extend tiered pricing to support group-based access control lists with record-level granularity; this allows the servers to set access rights based on users' price tiers. Next, we show how to do some basic bookkeeping to implement a novel top-K replication strategy that enables the servers to construct bestsellers lists, which facilitate faster retrieval for these most popular records. Finally, we build on our bookkeeping functionality to support multiple payees, thus enabling several sellers to offer their digital goods through a common database while enabling the database servers to determine to what portion of revenues each seller is entitled. Our protocols maintain user anonymity in addition to query privacy; that is, queries do not leak information about the index or price of the record a user purchases, the price tier according to which the user pays, the user's remaining balance, or even whether the user has ever queried the database before. No other priced PIR or oblivious transfer protocol supports tiered pricing, access control lists, multiple payees, or top-K replication, whereas ours supports all of these features while preserving PIR's sublinear communication complexity. We have implemented our protocols as an add-on to Percy++, an open source implementation of Goldberg's PIR scheme. Measurements indicate that our protocols are practical for deployment in real-world e-commerce applications.

This is a report of a working session on quality in the Working International Conference on Software Architecture, 2005

Architecture-based development of software product lines requires well established methodologies for both development and assessment of software product line architectures. While several methodologies for the development of such systems have been proposed, their assessment has mostly relied on methods developed for single product architectures. In this paper, we extend the popular ATAM (Architecture Tradeoff Analysis Method) method to cover both the core architecture of the product line and the individual product architectures. In addition, the extended method prescribes a qualitative analytical treatment of variation points using scenarios. We present the main tenets of the new method and illustrate its use through a small case study.