Published at IMC 2017.

The past 15 years of typosquatting research focused solely on web typosquatting. However, our previous research has shown that there is a great potential for typosquatting targeting protocols other than the web. The goal of this project was to understand the threat posed by email typosquatting.

We designed and implemented a distributed infrastructure to collect and process millions of spam and ham emails sent daily to typosquatting domains registered by us. We also developed a regression model to understand the impact of email typosquatting on users in the wild.

We found that users send hundreds of thousands of emails per year to 1,211 typosquatting domains and that these emails often contain sensitive information. Furthermore, our findings indicate that several typosquatters have an infrastructure in place to collect emails from tens of thousands of domain names.

Published at PETS 2017.

Research on censorship often leverages existing lists of known censored pages for validation. Unfortunately, these lists are often outdated, overlap, and do not cover some topics.

We developed an infrastructure to analyze the content, topic and lifetime of pages in these censorship lists, in order to understand how we could create better lists in the future.

First, we found that these lists often focus on a couple of topics too deeply, therefore researchers might want to balance the number of pages they use from each topic for their research. Second, pages covering controversial subjects have a shorter than average lifetime, and consequently, these lists need to be frequently maintained to keep them useful for analysis.

Published at USENIX Security 2014.

Previous work focused only on typosquatting targeting the most popular domain names and did not look at temporal evolution. Our focus was to study typosquatting on a large scale including typosquatting domains targeting less popular domain names.

To achieve this goal, we developed a three step methodology to find typosquatting domain names. We started by creating a list of millions of potential typosquatting domain names from joining the .com zone and Alexa's top 1 million domain list. Then, we collected Whois, DNS and web data for each candidate typosquatting domain name. And finally, using features extracted from the collected data, we classified domain names as true typosquatting (domains registered to profit from users' typing mistake) or not.

We found millions of true typosquatting domains often targeting less popular domain names. We showed that the number of typosquatting domain names steadily increases. Additionally, we discovered that typosquatting infrastructure is concentrated and a few name servers and registrars are used by the majority of typosquatters. Finally, we found that there is infrastructure specifically tailored for typosquatting where some name servers serve mainly typosquatting domain names.

Published at PAM 2012.

The goal of this project was to understand how domain names are used in the .biz Top-Level domain ten years after its introduction to DNS. We hoped to gain insight on the usefulness of the new gTLD program introduced by ICANN.

To achieve this goal, we collected and analyzed Whois records, DNS records, and the content of the main webpage of all 2 million .biz domain names and their .com namesakes.

We found that .biz haven't been able to catch up in popularity with .com and it induced a significant amount of speculative and defensive registrations.

Under the guidance of Dr. Mark Felegyhazi, Assistant professor at CrySyS Lab, I researched why people are registering domain names and how cybercriminals are abusing the Domain Name System. I was interested in three dimensions for categorization: 1. Topic (news, adult, IT, etc.), 2. Maliciousness (malicious or benign), 3. Whether the domain is active or passive (parking, defensive, redirected, etc.). For my M.Sc. thesis, I focused on the lexical properties of domain names. More details can be found in my M.Sc. thesis: Understanding the purpose of domain registrations

Under the guidance of Zoltan Faigl, Researcher at MIK, I studied future architectures for mobile packet switched traffic. Knowing that in the next decades the broadband mobile packet switched traffic load will be multiplied, presented a key challenge: to have a scalable architecture for mobile networks. At the time, hierarchical and central solutions were supported, but the question was: whether a decentralized architecture would make mobile networks more scalable. I made a discrete linear programming model for both types of architectures (hierarchical and decentralized) to find out which is more scalable in the long-term.

• Introduction to Computer Security 18-730: A
• Secure Software Systems 18-732: A

• Machine learning 10-601: A
• Machine learning 10-701: A-
• Artificial Intelligence Methods for Social Good 08-737: A

• Information Security: Good
• Security Protocols: Good (Excellent at final exam)
• Cryptography and Its Applications: Excellent
• Foundation of Secure Electronic Commerce: Excellent (Excellent at final exam)
• Secure Communication System Laboratory Exercise I: Good
• Secure Communication System Laboratory Exercise II: Excellent
• Practical Network Security: Excellent

• Newtorking Architectures: Excellent
• Mobile infocommunication networks: Good
• Navigation Services and Applications: Excellent