<?xml version="1.0" encoding="utf-8"?>
<export-example>
  <doc>
    <id>27448</id>
    <completedYear/>
    <publishedYear>2021</publishedYear>
    <thesisYearAccepted/>
    <language>eng</language>
    <pageFirst/>
    <pageLast/>
    <pageNumber>16</pageNumber>
    <edition/>
    <issue/>
    <volume/>
    <type>conferenceobject_ref</type>
    <publisherName>IEEE</publisherName>
    <publisherPlace/>
    <creatingCorporation/>
    <contributingCorporation/>
    <belongsToBibliography>0</belongsToBibliography>
    <completedDate>2021-05-10</completedDate>
    <publishedDate>--</publishedDate>
    <thesisDateAccepted>--</thesisDateAccepted>
    <title language="eng">Blocklist Babel: On the Transparency and Dynamics of Open Source Blocklisting</title>
    <abstract language="eng">Blocklists constitute a widely-used Internet security mechanism to filter undesired network traffic based on IP/domain reputation and behavior. Many blocklists are distributed in open source form by threat intelligence providers who aggregate and process input from their own sensors, but also from thirdparty feeds or providers. Despite their wide adoption, many open-source blocklist providers lack clear documentation about their structure, curation process, contents, dynamics, and interrelationships with other providers. In this paper, we perform a transparency and content analysis of 2,093 free and open source blocklists with the aim of exploring those questions. To that end, we perform a longitudinal 6-month crawling campaign yielding more than 13.5M unique records. This allows us to shed light on their nature, dynamics, inter-provider relationships, and transparency. Specifically, we discuss how the lack of consensus on distribution formats, blocklist labeling taxonomy, content focus, and temporal dynamics creates a complex ecosystem that complicates their combined crawling, aggregation and use. We also provide observations regarding their generally low overlap as well as acute differences in terms of liveness (i.e., how frequently records get indexed and removed from the list) and the lack of documentation about their data collection processes, nature and intended purpose. We conclude the paper with recommendations in terms of transparency, accountability, and standardization.</abstract>
    <parentTitle language="eng">IEEE Transactions on Network and Service Management</parentTitle>
    <identifier type="issn">1932-4537</identifier>
    <identifier type="doi">10.1109/TNSM.2021.3075552</identifier>
    <enrichment key="BTU">an der BTU erstellt / created at BTU</enrichment>
    <enrichment key="opus.source">publish</enrichment>
    <enrichment key="opus.doi.autoCreate">false</enrichment>
    <enrichment key="opus.urn.autoCreate">false</enrichment>
    <enrichment key="Fprofil">4 Künstliche Intelligenz und Sensorik / Artificial Intelligence and Sensor Technology</enrichment>
    <submitter>
      <firstName>Katrin</firstName>
      <lastName>Willhöft</lastName>
    </submitter>
    <author>
      <firstName>Álvaro</firstName>
      <lastName>Feal</lastName>
    </author>
    <author>
      <firstName>Pelayo</firstName>
      <lastName>Vallina</lastName>
    </author>
    <author>
      <firstName>Julien</firstName>
      <lastName>Gamba</lastName>
    </author>
    <author>
      <firstName>Sergio</firstName>
      <lastName>Pastrana</lastName>
    </author>
    <author>
      <firstName>Antonio</firstName>
      <lastName>Nappa</lastName>
    </author>
    <author>
      <firstName>Oliver</firstName>
      <lastName>Hohlfeld</lastName>
    </author>
    <author>
      <firstName>Narseo</firstName>
      <lastName>Vallina-Rodriguez</lastName>
    </author>
    <author>
      <firstName>Juan</firstName>
      <lastName>Tapiador</lastName>
    </author>
    <collection role="institutes" number="1203">FG Rechnernetze und Kommunikationssysteme</collection>
  </doc>
</export-example>
