Subject: [domainrep] Small footprint reputation system

From: "Rolf E. Sonneveld" <[email-masked]>
Date: Sun, 29 Aug 2010 00:37:58 +0200

Hi, all

to make a start with the list of requirements, proposed by Alessandro, 
here is the first item: small footprint reputation system. Some of the 
items/aspects below are not specific to the small footprint reputation 
system but equally apply to other types of reputation systems. Quite a 
number of the items below are copy-paste'd from mail from group members. 
Please note: I have tried to gather the information which was sent to 
the list by the list members, I have tried very hard to stay away from 
judging the contributions and from biased reading. As I've not have 
enough time to read all messages, it is my feeling that I'm still 
missing some information, regarding extra reputation fields (apart from 
the three mentioned below).

What has been proposed? Reputation provider provides an answer 
consisting of three numbers:

   1. quality score
   2. confidence
   3. NAICS (like) number

Characteristics:

    * small reputation answer (255 bytes and 512 bytes has been mentioned)
    * implementor-agnostic
    * domain reputation may not have impact on reputation of
      subdomain(s) or URIs and vice versa
    * not e-mail specific
    * location in DNS for domain: some.domain._rep.scorekeeper.example
    * location in DNS for specific protocol:
      some.domain.<protocol>_rep.scorekeeper.example
    * <protocol> can be:
    *    * uri scheme
    *    * port numbers (port 0 for ANY)
    *    * other
    * quality of domain score: 0-99
    * confidence of opinion score: 0-99
    * other proposal for score was: use one byte using two's complement
      arithmetic
    * cooperative distributed open database (question: is this part of
      the scope?)
    * A scalar reputation scoring is absolutely necessary
    * suggestion to use 'DNS Response Policy Zones (DNS RPZ)' to prevent
      attacks
    * multiple reputation providers

pro's mentioned by list members:

    * DNS has advantage when querying per message

con's mentioned by list members:

    * "That's not what the DNS is for!" resistance we get in the IETF
    * how does one avoid walking the DNS tree when making queries
      against domains that may not be real?
    * DNS is not good at exchanging details that are needed to sustain
      listings.  Because everyone uses a different database, the
      strategy has been to use xml schemes as templates for exchanging
      information between different databases.
    * it is not apparent how will this can block an exploit on some
      user's web page without blocking the entire domain
    * Nearly all large providers emit a fair amount of malicious content
      due to the number of compromised accounts

General remarks:

    * which identity has been adequately authenticated for the purpose
      of assigning administrative reputations
    * Solve the difficult problem first, the support of domain blocking
      decisions.

Questions asked, some of them still unanswered:

    * Will all unknown domains be initially assigned a maximal negative
      rating?
    * no XML for the small footprint reputation system?
    * Does this approach assume scorekeeper.example uses wildcard
      expansion to capture random sub-domains used by bad actors at high
      rates?
    * What is the result when scorekeeper.example does not respond
      before a DNS timeout?
    * What is the result when scorekeeper.example returns no answer for
      a domain being queried?
    * Shouldn't scorekeeper.example return an epoch time for the period
      a domain belongs to the same owner?
    * How does scorekeeper.example defend their service from abusive
      clients?
    * what is returned if domain is not present at reputation provider
      (NXDOMAIN)?
    * should there be correlation between domain reputations for
      different protocols (for the same domain)?
    * when URI reputation is to be addressed, do we need to look at path
      elements in addition to domains
    * why should the interesting part of the query have to include a
      domain name that exists in the DNS?

I suggest we now first concentrate on the list of questions, and try to 
find answers for those questions which has not yet been answered.

I plan to send two message on Monday: one on 'Scope' and one on 
'Industry Taxonomy'.
Have a nice weekend,

/rolf