OpenINTEL: security benefits from actively measuring 60% of the global DNS every 24 hours

Since 2015, SURFnet, SIDN and the University of Twente are collaborating on the OpenINTEL active DNS measurement project. The project consists of a measurement infrastructure that captures the state of over 60% of the global DNS every 24 hours. In this talk, we will introduce OpenINTEL, and will explain how we manage to measure 210 million domains on the Internet, sending over 2.2 billion queries per day. Then, using four real-world case studies, we will demonstrate how these active DNS measurements have security applications and can help pro-actively detect threats, improve e-mail security and assess the damage of large scale attacks on Internet services. For more information on OpenINTEL, you can also visit the project website at https://openintel.nl/

Speakers

• Roland van Rijswijk-Deij SURFnet bv

Authors

• Roland M. van Rijswijk-Deij