Changes

'''NetBeacon Measurement and Analytics Platform (MAP)''' (formerly '''DNSAI:Compass''' until June, 2023 and '''DNSAI Intelligence''' until September, 2022) is [[NetBeacon Institute]] initiative to measure and track the use of the DNS for [[phishing]] and [[malware]], and the goal is to reduce [[DNS Abuse]] at the DNS level <ref name="mapintro">[https://netbeacon.org/map-analytics/ Map Introduction]</ref>. It was initially launched in September, 2022, but the first publication about the initiative was in May, 2022 <ref>https://netbeacon.org/measuring-dns-abuse-our-first-report/</ref>. In June, 2023, the Institute announced the addition of a new level of reporting for their measurement project, which was then called NetBeacon Measurement and Analytics Platform (MAP).<ref>https://netbeacon.org/a-new-phase-of-measuring-dns-abuse/</ref>

'''NetBeacon Measurement and Analytics Platform (MAP)''' (formerly '''DNSAI:Compass''' until June, 2023 and '''DNSAI Intelligence''' until September, 2022) is [[NetBeacon Institute]] initiative to measure and track the use of the DNS for [[phishing]] and [[malware]], and the goal is to reduce [[DNS Abuse]] at the DNS level <ref name="mapintro">[https://netbeacon.org/map-analytics/ Map Introduction]</ref>. It was initially launched in September, 2022, but the first publication about the initiative was in May, 2022 <ref name="1strep">[https://netbeacon.org/measuring-dns-abuse-our-first-report/ First Report]</ref>. In June, 2023, the Institute announced the addition of a new level of reporting for their measurement project, which was then named NetBeacon Measurement and Analytics Platform (MAP).<ref name="measuring">[https://netbeacon.org/a-new-phase-of-measuring-dns-abuse/ Measuring]</ref>

==Collaborations==

==Collaborations==

NetBeacon MAP is a collaboration with [[KOR Labs]], led by Dr. [[Maciej Korczynski]]. KOR Labs is responsible for collecting the data following an established methodology. This data is then provided to the Institute, that works with [[PIR]]’s Data Analytics team to create interactive charts, reports, and individualized dashboards.<ref name="mapintro"></ref>

NetBeacon MAP is a collaboration with [[KOR Labs]], led by Dr. [[Maciej Korczynski]]. KOR Labs is responsible for collecting the data following an established methodology. This data is then provided to the Institute, that works with [[PIR]]’s Data Analytics team to create interactive charts, reports, and individualized dashboards <ref name="mapintro"></ref>.

==Methodology==

==Methodology==

=== Data Collection and Processing ===

=== Data Collection and Processing ===

* '''URL Blocklists:''' Utilizes data from reputable sources (APWG, PhishTank, OpenPhish, ABUSE.ch) to gather URLs associated with phishing and malware.

* '''URL Blocklists:''' Utilizes data from reputable sources ([[APWG]], PhishTank, OpenPhish, ABUSE.ch) to gather URLs associated with phishing and malware.

* '''Domain Names:''' Collects domain names from various TLDs using zone files and other measurement methods to ensure a comprehensive list.

* '''Domain Names:''' Collects domain names from various [[TLDs]] using zone files and other measurement methods to ensure a comprehensive list.

* '''Technical Registration Information:''' Gathers registration details using RDAP/WHOIS protocols to identify registrars and gather creation/expiration dates of domains.

* '''Technical Registration Information:''' Gathers registration details using [[RDAP]]/[[WHOIS]] protocols to identify registrars and gather creation/expiration dates of domains.

* '''Uptime Measurements:''' Measures the time between a domain being blocklisted and the mitigation of the abuse (e.g., removal of malicious content).

* '''Uptime Measurements:''' Measures the time between a domain being blocklisted and the mitigation of the abuse (e.g., removal of malicious content).

=== Challenges and Limitations ===

=== Challenges and Limitations ===

* Acknowledges various challenges in data collection, such as false positives, limitations in WHOIS data, and difficulties in identifying ccTLD registrars.<ref>https://web.archive.org/web/20221206141218/https://dnsabuseinstitute.org/wp-content/uploads/2022/10/DNSAI-Compass-Methodology.pdf</ref>

* Acknowledges various challenges in data collection, such as false positives, limitations in WHOIS data, and difficulties in identifying [[ccTLD]] registrars.<ref name="methodology">[https://web.archive.org/web/20221206141218/https://dnsabuseinstitute.org/wp-content/uploads/2022/10/DNSAI-Compass-Methodology.pdf Methodology]</ref>

== Reports ==

== Reports ==

NetBeacon MAP can can be consumed in three formats:  

NetBeacon MAP can can be consumed in three formats:  

'''NetBeacon MAP: Monthly Analysis''' reports provide detailed tables identifying registrars and TLDs with high and low relative levels of malicious phishing and malware in their domains under management (DUM) and compared to their new monthly registrations.<ref>https://netbeaconurprd.wpenginepowered.com/map-monthly-analysis/</ref> On September 16, 2022, the first report was launched, and focused on higher level aggregate data from May, June, and July 2022. There reports continued monthly.<ref>https://netbeacon.org/measuring-dns-abuse-our-first-report/</ref> In April, 2024, the Institute launched its twentieth report.  

'''NetBeacon MAP: Monthly Analysis''' reports provide detailed tables identifying registrars and TLDs with high and low relative levels of malicious phishing and malware in their domains under management (DUM) and compared to their new monthly registrations <ref name="analysis">[https://netbeaconurprd.wpenginepowered.com/map-monthly-analysis/ Analysis]</ref>. On September 16, 2022, the first report was launched, and focused on higher level aggregate data from May, June, and July 2022. There reports continued monthly <ref name="1strep"></ref>. In April, 2024, the Institute launched its twentieth report.  

'''NetBeacon MAP: Charts''' can be used by [[registries]] and [[registrars]] to understand how often the DNS is used for phishing and malware, whether abuse is mitigated, how quickly, and the type of registrations (compromised website or maliciously registered domain).<ref name="charts">[https://netbeaconurprd.wpenginepowered.com/map-analytics/map-interactive-charts/ Interactive Charts]</ref>

'''NetBeacon MAP: Charts''' can be used by [[registries]] and [[registrars]] to understand how often the DNS is used for phishing and malware, whether abuse is mitigated, how quickly, and the type of registrations (compromised website or maliciously registered domain) <ref name="charts">[https://netbeaconurprd.wpenginepowered.com/map-analytics/map-interactive-charts/ Interactive Charts]</ref>.

'''NetBeacon MAP: Dashboards''' permits registries and registrars to understand, track and benchmark the impact of their efforts to combat DNS Abuse. Accessing one's organizational dashboard helps to understand how much phishing and malware NetBeacon MAP has identified in a particular zone, whether it has been mitigated, and how this compares to one's peers. It's possible to view analysis on whether the domain name was maliciously registered for the purposes of DNS Abuse or is associated with an issue of compromise (typically website compromise). Data can be used to track and measure the prevalence of abuse as well as how changes in one's processes and policies make an impact over time.<ref>https://netbeaconurprd.wpenginepowered.com/individual-dashboards/</ref>

'''NetBeacon MAP: Dashboards''' permits registries and registrars to understand, track and benchmark the impact of their efforts to combat DNS Abuse. Accessing one's organizational dashboard helps to understand how much phishing and malware NetBeacon MAP has identified in a particular zone, whether it has been mitigated, and how this compares to one's peers. It's possible to view analysis on whether the domain name was maliciously registered for the purposes of DNS Abuse or is associated with an issue of compromise (typically website compromise). Data can be used to track and measure the prevalence of abuse as well as how changes in one's processes and policies make an impact over time <ref name="dashboard">[https://netbeaconurprd.wpenginepowered.com/individual-dashboards/ Dashboards]</ref>.

===Results===

===Results===

| Feb-2024  || 67 || 36 || 91 || 64

| Feb-2024  || 67 || 36 || 91 || 64

|}

|}

'''Table 3: Malicious vs. Compromised:''' This table is intended to show the observed registration type (malicious registration or a benign domain associated with a compromised website) and how this is changing over time. This is an important distinction because it impacts which mitigation action is most  appropriate, and which actor is best placed to mitigate. Domain names that have been maliciously registered for the purpose of DNS Abuse are typically more appropriate for mitigation at the DNS level. A benign domain name that is associated with an issue of compromise is typically inappropriate for DNS level mitigation due to the associated collateral damage.  

'''Table 3: Malicious vs. Compromised:''' This table is intended to show the observed registration type (malicious registration or a benign domain associated with a compromised website) and how this is changing over time. This is an important distinction because it impacts which mitigation action is most  appropriate, and which actor is best placed to mitigate. Domain names that have been maliciously registered for the purpose of DNS Abuse are typically more appropriate for mitigation at the DNS level. A benign domain name that is associated with an issue of compromise is typically inappropriate for DNS level mitigation due to the associated collateral damage.