Network traffic classification solutions have increasingly adopted complex models to improve performance. Yet, we show that a simple 1-nearest neighbor classifier-using only a compact feature vector from the first ten packets of each flow-matches or even outperforms recent deep learning models on eight popular benchmark datasets, even when trained on just 10% of the data. The evidence points to sample redundancy, not architectural invention, as the main source of reported gains. The redundant flows in benchmark datasets, combined with an inadequate evaluation, obscure the field's actual progress rate. Therefore, we call for redundancy-aware evaluation protocols and new, heterogeneous datasets that test real-world generalization in an operational environment.
Effective vulnerability management is fundamental for cybersecurity, requiring significant manual effort to identify, classify, and prioritize reports. Automating this process could reduce analyst workload and improve response to threats. We explore the use of Large Language Models (LLMs) for representing and analyzing Common Vulnerabilities and Exposures (CVEs), specifically their ability to generate semantic embeddings that capture the nature of vulnerabilities from textual descriptions. Using a dataset of 4,710 CVEs, we generate vector embeddings with multiple LLMs. We then apply both unsupervised clustering and supervised classification to evaluate the quality of the embeddings. Our preliminary results show that some LLMs - in particular Llama 3.2 - map similar vulnerabilities together in the embedding space. Embeddings seen to position related vulnerabilities in nearby regions, with certain clusters showing strong correspondence to specific categories like SQL Injection (CWE-89) and Path Traversal (CWE-22). A simple KNN classifier using only the embeddings achieves around 50% accuracy when categorizing CVEs. This is a remarkable result, considering the very high number of classes in the problem. Our initial findings show potential for the use of LLMs in vulnerability management processes, calling for deeper analysis on how to better learn representations from vulnerability reports.
Since the exhaustion of unallocated IP addresses at the Internet Assigned Numbers Authority (IANA), a market for IPv4 addresses has emerged. In complement to purchasing address space, leasing IP addresses is becoming increasingly popular. Leasing provides a cost-effective alternative for organizations that seek to scale up without a high upfront investment. However, malicious actors also benefit from leasing as it enables them to rapidly cycle through different addresses, circumventing security measures such as IP blocklisting. We explore the emerging IP leasing market and its implications for Internet security. We examine leasing market data, leveraging blocklists as an indirect measure of involvement in various forms of network abuse. In February 2025, leased prefixes were 2.89x more likely to be flagged by blocklists compared to non-leased prefixes. This result raises questions about whether the IP leasing market should be subject to closer scrutiny.
In recent years, the Internet has experienced a significant surge in connected devices, with an ever-growing number of sensors and monitoring systems-spanning industries and domestic networks-now exposed to the Internet and reliant on our ability to keep them secure (e.g., in healthcare, home automation, and manufacturing). However, securing Internet-facing devices is no trivial task. Applying patches, firewall rules, and strong credentials are only small steps during their security life-cycle. Since these steps work in tandem, failing even a few can significantly increase the risk of compromise. The cybersecurity community continues to build on its efforts to mitigate this issue from many fronts, all while investigating society's new challenges with technology and their security implications. To aid in this task, we present DICE, a modular Device Identification and Classification Engine to detect vulnerabilities on Internet-facing devices. DICE assists in most phases of the identification process, from automating Internet-wide scans to labeling results. In addition, DICE can help notify the affected device owners - an ongoing issue across the literature - by creating detailed reports and mitigation strategies. As proof of concept, we share preliminary implementations of various modules to identify recurrent issues in 8 protocols widely used in IoT and OT devices. These modules aim to discover security pitfalls beyond common vulnerabilities, such as signs of abandonment, obsolescence, and security negligence.
While the QUIC specification now includes mechanisms to prevent DoS attacks, they might not always be enforced by servers. With the increasing deployment of QUIC servers, it is now becoming more important to avoid vulnerabilities that could be exploited on a large scale. This paper presents an extensive study of the current state of QUIC servers and how they implement the mechanisms to prevent DoS attacks. The paper focuses on two different amplification DoS attacks that can be performed using QUIC HTTP/3 servers, enabled by the handshake and the connection migration mechanism. We investigate how QUIC servers respond to these attacks and if they are compliant with the general guidelines regarding the amplification protection. Our results show that while a large proportion of QUIC servers are respectful of the specification, around 20% of the IPv4 servers tested are still breaking the amplification limit for the handshake attack while most of the IPv6 servers are compliant. Most of the servers who support connection migration use the path validation mechanism, preventing the attack on connection migration. Overall, the amplification factor of the attacks remains quite low with a median slightly lower than the limit of 3, set in the standard, for the handshake attack and under 1 for the migration attack.
Honeypots are versatile cyber-deception tools used to detect and analyze malicious activity across various environments, including operational technology (OT) systems that support critical infrastructure. Their effectiveness, however, depends on remaining undetectable to increasingly sophisticated attackers who employ fingerprinting techniques. This work introduces Aletheia, a framework for fingerprinting OT honeypots agnostically, by reversing the TCP/IP stack. We conduct an Internet-wide scan targeting the Modbus and S7comm protocols, identifying approximately 6 million responsive IPv4 addresses. Applying only a subset of our methodology, we uncover around 7,000 potential honeypot instances-including custom implementations-demonstrating, even at this preliminary stage, how our holistic framework combines established techniques with novel fingerprinting methods to reveal previously unidentified honeypots.
While much measurement research has highlighted the increased adoption of HTTPS and better security practices, the trustworthiness of a domain is not solely determined by the security properties of its end-to-end connections. To separate and highlight this distinction, we present a comprehensive analysis of secure communication practices across different categories of web domains, placing particular focus on the direct comparison of four classes of "malicious" domains (fake news, spam, phishing, and malware) with domains selected along three dimensions: domain popularity, service type, and geographical registration. For each domain class, we present a high-level characterization, focusing on fundamental aspects that influence connection security. Through a comparative analysis of default protocols, cipher suites, and vulnerability susceptibility, we illuminate disparities in the implementation of different domains' secure communications. Our findings showcase several shortcomings in safety standards among many "benign" domains and show that fake news and malware domains often resemble benign domains in their security practices. In contrast, phishing domains exhibit a higher level of security awareness, while spam domains tend to employ weaker security measures. Overall, our findings underscore the critical need to disentangle secure connections from domain trustworthiness, advocating for clearer distinctions to help safeguard Internet users and enhance Internet security.
We introduce GNN4Alloc, a learning-based framework for resource allocation in highly distributed Content Delivery Networks (CDNs). Focusing on the core challenges of content placement and routing, GNN4Alloc leverages Graph Neural Networks (GNNs) to enhance decision-making efficiency in dynamic and large-scale environments. Building on prior work that employs mathematical optimization and heuristic algorithms, we reformulate these problems using graph representation learning, leveraging the bipartite nature of content-to-node assignment and routing decisions in CDN resource allocation. The framework incorporates GNN-based modules - including neural algorithm executors and constrained optimization layers - to develop adaptive allocation policies that generalize across diverse network topologies and demand profiles. By doing so, GNN4Alloc aims to improve both the scalability and solution quality of content allocation strategies, contributing to the broader goal of advancing GNN-based control in distributed systems.
Network attacks are a growing problem in today's world. Their number is growing exponentially, and they become more sophisticated every year, accentuating the need for robust Network Intrusion Detection Systems. Graph Neural Networks have been proven to be very capable in detecting and categorising network attacks, making them ideal for detection in real-life deployments. However, they are limited to training on a small number of outdated labelled datasets. We propose a new method for anomaly detection through a graph heterogeneous autoencoder as a way to reduce reliance on labelled datasets. Our graph autoencoder reconstructs the structure and features of a graph representing the traffic connections in a network. We train the autoencoder with normal graphs and then derive embeddings to use with traditional anomaly detection based on Machine Learning. Our results indicate that our solution can create distinct normal and anomalous graph embeddings that can then be used to detect attacks with a high degree of accuracy.
We introduce FREKit, a novel network simulator tailored for research in congestion modeling, fast rerouting, and multi-protocol environments. Existing simulators are either too slow, lack multi-protocol support, or do not offer rich congestion-based metrics and aggregations, limiting their suitability for the type of research FREKit targets. Designed around the pipe-based abstraction - assuming known traffic matrices, FREKit evaluates system-wide behaviors with elastic and inelastic congestion computation models, providing fine-grained insights over interface-level loads. FREKit supports multiple protocols - including IPv4, IPv6, MPLS, and Segment Routing - along with various path search algorithms and rapid prototyping. Its probabilistic link failure framework enables congestion-aware resilience studies and advanced congestion metrics such as value-at-risk (VaR). The simulator is implemented in Python with efficient data structures (NumPy, NetworkX) and optimized via multiprocessing and dynamic programming. Despite being in active development, FREKit is already proving valuable in research on fast rerouting and source routing, demonstrating its potential to enable sophisticated congestion-aware network studies.
Caching has been a fundamental feature of the Domain Name System (DNS) since its inception. Resolvers cache the response to a query - whether that response was a name-to-resource mapping or a code indicating that no mapping exists. Recent additions to the DNS include a behavior known as aggressive negative caching, wherein resolvers simply infer that no mapping exists, based on previous responses, thus saving a query to authoritative servers. In this paper we perform the first known study of aggressive negative caching in the wild. We issue experimental queries to resolvers associated with 2,500 world-wide RIPE Atlas probe to detect the behavior in real resolvers. We observe aggressive negative caching in roughly half of the resolvers we analyzed. We also perform an analysis of several open source DNS resolver implementations, which show both that behaviors differ between implementations and that implementations are often consistent with their own documentation.
Several governments are gradually choosing to monitor VPN traffic. In this paper, we explore how hard or easy it would be for large ISP-scale adversaries to identify and block VPN traffic. More specifically, we try to answer questions like should ordinary netizens fear such decisions or whether it is not as trivial to identify and block all sorts of VPNs. A recent study found that blocking and identifying OpenVPN endpoints is feasible for small ISPs. We explored detecting Open-VPN and alternatives like TLS, SSH, IPSec/IKEv2, Wireguard, and proprietary VPNs. Analyzing seven popular commercial and open-source VPN services, we identified patterns for detection. While OpenVPN is easily spotted, many alternatives resist identification, some using tactics like obscure TLS ClientHello SNI strings. We demonstrated evasion methods, including altering packet sizes, sending dummy traffic to confuse middleboxes, and obscuring plaintext strings. We also proposed a scalable mechanism for OpenVPN services to hide identifiable plaintext without affecting user or gateway scalability.
The new email sender guidelines introduced by Google on October 3, 2023, mandate sender authentication protocols, such as Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC), to minimize unsolicited emails to Gmail addresses. Google asserted that these guidelines would improve email security. However, an August 2024 report indicated that 8 million of the top 10 million domains ranked by web traffic had not implemented DMARC. This large-scale measurement study analyzes entities that did not implement the required email security measures. Our findings demonstrate low SPF, DKIM, and DMARC adoption among domains associated with China, South Korea, and Japan. Gmail is blocked in China owing to censorship. NAVER, which is a prominent search engine, offers free email addresses, diminishing the need for compliance in South Korea. Despite the search engine dominance of Google in Japan, the lagging adoption suggests that non-compliance arises from other constraints, and not necessarily intent. In addition, business-to-business sectors exhibited limited adoption, likely because Gmail addresses hold less operational relevance. While some entities are exempt from the guidelines, others did not comply for certain reasons, notwithstanding enforcement by a powerful organization. Ultimately, if nothing changes with such an organization, it is necessary to discuss how email security should be approached, whether ensuring security requires enforcement power, such as national regulations, or whether there is still room for technical approaches within the Internet community.
The arrival of quantum computers will significantly impact our current Internet infrastructures as quantum computers will be able to break current public key cryptography. This means that we need to replace cryptographic algorithms by quantum-safe alternatives, also known as Post Quantum Cryptography (PQC). Many protocols and architectures need to make this transition. While the Internet community is making steady progress on transitioning TLS to PQC, there are still many protocols for which action needs to be taken, especially in more complex scenarios where protocols span multiple layers of the stack. In this paper, we study such a complex scenario: Federated Identity architectures. The objective of these architectures is to allow access to multiple services using a single set of login credentials, improving convenience and security across different organizations or domains. In particular we examine the Hub'n'Spoke model, where multiple parties exchange data through a central hub. This hub manages most of the infrastructure workload and deals with many heterogeneous devices and protocols, making it a perfect test case for the PQC transition. Using real-world data from an operator of a large academic identity federation, we benchmark five PQC algorithms finalized by NIST. We also quantify the toll this transition imposes on computational efficiency and hardware capacity. We show that while there is an ever increasing interest towards PQC adoption, many technical challenges remain unaddressed, showing that the Post Quantum transition process is fragmented, with many components of the ecosystem that are still insufficiently taken into consideration.
Network operators require comprehensive and comprehensible network monitoring to manage resources, measure performance, ensure compliance, conduct audits, and detect/mitigate security threats. DNS labeling is one of the most useful techniques for tracking network activity, enabling operators to understand the web services that hosts communicate with. However, DNS-based monitoring has a blind spot: traffic to IPs with no associated DNS records, which we call orphan flows/IPs. Orphan flows can often indicate peer-to-peer or VPN communication, as well as bootstrap network services (e.g., root DNS / NTP servers), or software that is attempting to circumvent domain blocklisting systems. This work presents the first large-scale analysis of orphan flows to understand 1) the practical hurdles to measuring orphan flows, and 2) the potential utility of orphan flow identification for network operators and security analysts. Our seven-month study examines traffic from a large U.S. university with over 3.3 billion flows per day. We construct a robust multi-stage traffic analysis pipeline that accounts for practical challenges (e.g., data loss, clock skew) in order to hone in on true orphan flows. In total, we find communication to 26K orphan IPs, 63% of which we can categorize into behavior ranging from Windows update servers to malware-related traffic. Notably, we suspect 2.5% of the orphan IPs to be potentially malicious, but they do not appear in known threat intelligence sources. Ultimately, we shed light on a blind spot for network operators and highlight new monitoring opportunities.
Decentralized storage platforms distribute control across individual peers, thus reducing reliance on a single entity and mitigating common vulnerabilities of centralized storage systems. In this paper, we compare the architecture and operation of four popular decentralized storage platforms: IPFS, Filecoin, Swarm, and Storj. Our study reveals significant implementation differences in four key aspects: data routing, data persistence, incentivization mechanisms, and resource requirements. These architectural decisions directly influence network characteristics, performance metrics, and economic sustainability. We collect comprehensive snapshots of the entire network to analyze network properties including peer uptime, geographical distribution, and network availability. Our analysis shows that while IPFS maintains the largest user base, it exhibits the lowest peer uptime due to lack of incentivization, with 50% of peers online for less than 4 days. In contrast, incentivized platforms exhibited median peer uptimes around 80-96% of the study period. We found considerable performance variations that directly correlate with implementation choices. Storj, with its centralized data routing architecture, achieves performance nearly on par with centralized solutions like Google Drive. In contrast, Swarm showed the slowest performance metrics with its full commitment to decentralization. Finally, our analysis reveals that cryptocurrency price fluctuations significantly influence participation and cost, suggesting potential sustainability challenges in these decentralized storage platforms.
The Resource Public Key Infrastructure (RPKI) enhances routing security by providing cryptographically verifiable objects containing the Autonomous System (AS) numbers authorized to originate IP address ranges. Relying Party (RP) software performs RPKI synchronization by downloading, validating, and processing data from RPKI Publication Points (PPs) that are then provided to the routers to decide on accepting or rejecting BGP announcements. While RPKI is gaining importance, synchronization delays can compromise BGP reactivity, causing ASes to accept outdated or invalid announcements and potentially leading to service disruptions. We study the causes of delay in RPKI synchronization by examining the key characteristics of the RPKI system, such as Route Origin Authorization (ROA) structures, RPKI operational modes, certificate chains, and the networking delays to access PPs. Our findings reveal that bundling multiple prefixes into a single ROA reduces validation delays by up to threefold. Depending on the ROA structure and publication infrastructure of delegated Certificate Authorities (CAs), they can reduce RP synchronization delays or inflate them by up to 90%. Some regions worldwide observe delays of a few milliseconds and others of several hundred milliseconds in accessing RPKI resources. Every additional 100 milliseconds of Round Trip Time (RTT) can delay the RP synchronization by up to 25 extra seconds.
In today's society, ensuring the safety of children online has become a priority for parents, educators, and policymakers. Parental control systems are widely used to restrict access to age-inappropriate online content, offering a tool for protecting children from potential online risks. However, their blocking behavior across different technologies remains hidden and poorly analyzed. In this paper, we present a comparative analysis of seven parental control solutions: three provided by routers with built-in filtering functionalities (TP-Link, Netgear, and ASUS), two services provided by DNS resolvers (OpenDNS and DNS0.eu), and a software tool (Norton Family). Each system was tested by systematically visiting a large set of domains and recording which ones were blocked. We then classified all domains into content categories and used this classification to evaluate the consistency and selectivity of each parental control system. Our findings show that parental controls frequently fall short of providing adequate protection: Some systems fail to block up to 96% of sensitive domains, while others block appropriate content or apply inconsistent and arbitrary filtering rules. For example, ASUS allows access to over 95% of gambling websites, and Netgear exhibits internal inconsistencies, with one-third of the domains blocked under its "Adult" settings remaining accessible under its stricter "Child" setting. These results provide insight into the real-world operation of popular parental control technologies and show a methodology for evaluating category-based filtering at scale.
Domain Name System (DNS) resolution, a fundamental component of Internet communication, plays a crucial role in how data centers function and deliver services to end-users. This article addresses a significant research gap in energy-efficient data center management by focusing on measuring and analysing DNS resolver energy consumption. We introduce a mathematical model to estimate the number of transmitted packets, conduct controlled experiments, and examine the energy impact of security mechanisms such as TLS handshakes and encryption/decryption processes. As part of this ongoing work, we aim to refine the model based on experimental results and leverage it to support the evaluation and optimization of DNS operations in data center environments.
Domain Name System (DNS) records are frequently used to investigate a wide variety of Internet phenomena including topology, malicious activity, resource allocations and user behavior. The scope and utility of the results of these studies depends intrinsically on the representativeness of the DNS data. In this paper, we compare and contrast five different DNS datasets from four different providers collected over a period of 3 months that in total comprise over 10.1B total Fully Qualified Domain Names (FQDNs) of which 3.7B are unique. We process and organize that data into a consistent format that enables it to be efficiently analyzed in Google BigQuery. We begin by reporting the details of the measurement methods and the datasets used in our analysis. We then analyze the relative coverage of each dataset by structural, administrative, and client-behavioral features. We find that while there are significant overlaps in the records provided by each dataset, each also provides unique records not found in the other datasets that are important in different use cases. Our results highlight the opportunities in using these datasets in research and operations, and how combinations of datasets can provide broader and more diverse perspectives.
