Internet Measurements and Analysis
93 publications
-
A Leaner and Faster Web: How CBOR Can Improve Dynamic Content Encoding in JSON and DNS over HTTPSIEEE Transactions on Network and Service Management (TNSM), 2026accepted for publication
-
A Call to Reconsider Certification Authority AuthorizationIEEE Security & Privacy, 24(1), pp. 35–43, 2026
-
Contrastive Learning and Correlation Clustering for Sequences of Network Telescope DataTechnical Report arXiv:2606.04733, Open Archive: arXiv.org, 2026
-
Scanning the IPv6 Internet Using Subnet-Router Anycast ProbingProceedings of the ACM on Networking, 3(CoNEXT4), pp. 50:1–50:15, 2025
-
Waiting for QUIC: Passive Measurements to Understand QUIC DeploymentsProceedings of the ACM on Networking, 3(CoNEXT4), pp. 41:1–41:26, 2025
-
A Detailed Measurement View on IPv6 Scanners and Their Adaption to BGP SignalsProceedings of the ACM on Networking, 3(CoNEXT3), pp. 15:1–:15:23, 2025
-
Toward a Better Understanding of IoT Domain Names: A Study of IoT BackendIEEE Access, 13, pp. 68871–68890, 2025
-
The SAP Cloud Infrastructure Dataset: A Reality Check of Scheduling and Placement of VMs in Cloud ComputingIn: Proc. of ACM Internet Measurement Conference (IMC), pp. 746–760, ACM, 2025
-
Forward to Hell? On the Potentials of Misusing Transparent DNS Forwarders in Reflective Amplification AttacksIn: Proc. of ACM CCS, pp. 3915–3929, ACM, 2025
-
Lessons Learned from Operating a Large Network TelescopeIn: Proc. of ACM SIGCOMM, pp. 826–841, ACM, 2025
-
POSTER: Towards a Complete View of Encrypted Client Hello DeploymentsIn: Proc. of ACM SIGCOMM: Posters and Demos, pp. 22–24, ACM, 2025
-
DEMO: Hilby – Hilbert Interactive Prefix PlotsIn: Proc. of ACM SIGCOMM: Posters and Demos, pp. 134–136, ACM, 2025
-
POSTER: Challenges in VM Scheduling and Placement: Insights from a Real-World SAP Cloud DatasetIn: Proc. of ACM SIGCOMM: Posters and Demos, pp. 124–126, ACM, 2025
-
POSTER: Two-Phase Scanning in IPv6 – First Observations from a Reactive IPv6 Network TelescopeIn: Proc. of ACM SIGCOMM: Posters and Demos, pp. 103–105, ACM, 2025
-
A Leaner and Faster Web: How CBOR Can Improve Dynamic Content Encoding in JSON and DNS over HTTPSTechnical Report arXiv:2512.12067, Open Archive: arXiv.org, 2025
-
Combating the Effects of Cyber-Psychosis: Using Object Security to Facilitate Critical ThinkingTechnical Report arXiv:2503.16510, Open Archive: arXiv.org, 2025
-
Proceedings of the 8th Network Traffic Measurement and Analysis Conference (TMA)Proceedings of the 8th Network Traffic Measurement and Analysis Conference (TMA), IEEE Press, 2024
-
A Security Model for Web-Based CommunicationCommunications of the ACM, 67(10), pp. 83–90, 2024
-
A Review of Techniques for Ageing Detection and Monitoring on Embedded SystemsACM Computing Surveys, 57(1), pp. 24:1–24:34, 2024
-
The Log4j Incident: A Comprehensive Measurement Study of a Critical VulnerabilityIEEE Transactions on Network and Service Management, 21(6), pp. 5921–5934, 2024
-
The Resource Public Key Infrastructure (RPKI): A Survey on Measurements and Future ProspectsIEEE Transactions on Network and Service Management, 21(2), pp. 2353–2373, 2024
-
ReACKed QUICer: Measuring the Performance of Instant Acknowledgments in QUIC HandshakesIn: Proc. of ACM Internet Measurement Conference (IMC), pp. 389–400, ACM, 2024
-
The Age of DDoScovery: An Empirical Comparison of Industry and Academic DDoS AssessmentsIn: Proc. of ACM Internet Measurement Conference (IMC), pp. 259–279, ACM, 2024
-
Transparent DNS Forwarders: A (Still) Unnoticed Component of the Open DNS InfrastructureIn: Proc. of Workshop on DNS and Internet Naming Research (DINR2024), Information Science Institut (USC), Los Angeles, 2024
-
Do CAA, CT, and DANE Interlink in Certificate Deployments? A Web PKI Measurement StudyIn: Proc. of 8th Network Traffic Measurement and Analysis Conference (TMA), IEEE, 2024
-
From Files to Streams: Revisiting Web History and Exploring Potentials for Future ProspectsIn: Companion Proceedings of the ACM The Web Conference, pp. 1119–1122, ACM, 2024
-
How to Measure TLS, X.509 Certificates, and Web PKI: A Tutorial and Brief SurveyTechnical Report arXiv:2401.18053, Open Archive: arXiv.org, 2024
-
Securing Name Resolution in the IoT: DNS over CoAPProceedings of the ACM on Networking, 1(CoNEXT2), pp. 6:1–6:25, 2023
-
SoK: A Data-driven View on Methods to Detect Reflective Amplification DDoS Attacks Using HoneypotsIn: Proc. of IEEE Euro Security & Privacy, pp. 576–591, IEEE, 2023
-
Speed Up the Web with Universal CSS RenderingIn: Proc. of 23rd International Conference on Web Engineering (ICWE), pp. 191–205, Springer, Cham, 2023
-
Waiter and AUTRATAC: Don't Throw It Away, Just Delay!In: Proc. of 23rd International Conference on Web Engineering (ICWE), pp. 278–292, Springer, Cham, 2023
-
How Streaming Can Improve the World (Wide Web)In: Companion Proceedings of the ACM Web Conference (WWW '23 Companion), pp. 140–143, ACM, 2023
-
DDoS Attacks: Coverage, Mitigation, and PreventionPh.D. thesis, Department of Mathematics and Computer Science, Freie Universität Berlin, 2023
-
SoK: A Data-driven View on Methods to Detect Reflective Amplification DDoS Attacks Using HoneypotsTechnical Report arXiv:2302.04614, Open Archive: arXiv.org, 2023
-
A Review of Techniques for Ageing Detection and Monitoring on Embedded SystemsTechnical Report 2301.06804, , 2023
-
From the Beginning: Key Transitions in the First 15 Years of DNSSECIEEE Transactions on Network and Service Management, 19(4), pp. 5265–5283, 2022
-
★ Best Paper Award, Best Community Contribution AwardOn the Interplay between TLS Certificates and QUIC PerformanceIn: Proc. of 18th International Conference on emerging Networking EXperiments and Technologies (CoNEXT), pp. 204–213, ACM, 2022
-
Spoki: Unveiling a New Wave of Scanners through a Reactive Network TelescopeIn: Proc. of 31st USENIX Security Symposium, pp. 431–448, USENIX Association, 2022
-
The Race to the Vulnerable: Measuring the Log4j Shell IncidentIn: Proc. of Network Traffic Measurement and Analysis Conference (TMA), IFIP, 2022
-
Waiting for QUIC: On the Opportunities of Passive Measurements to Understand QUIC DeploymentsTechnical Report arXiv:2209.00965, Open Archive: arXiv.org, 2022
-
Securing name resolution in the IoT: DNS over CoAPTechnical Report arXiv:2207.07486, Open Archive: arXiv.org, 2022
-
Auslandsverbindungen und CDN-Kompetenz (ZwIBACK). Zweite Internet Backbone-StudieTechnical Report, BSI, 2022
-
Transparent Forwarders: An Unnoticed Component of the Open DNS InfrastructureIn: Proc. of 17th International Conference on emerging Networking EXperiments and Technologies (CoNEXT), pp. 454–462, ACM, 2021
-
The Far Side of DNS Amplification: Tracing the DDoS Attack Ecosystem from the Internet CoreIn: Proc. of ACM Internet Measurement Conference (IMC), pp. 419–434, ACM, 2021
-
QUICsand: Quantifying QUIC Reconnaissance Scans and DoS Flooding EventsIn: Proc. of ACM Internet Measurement Conference (IMC), pp. 283–291, ACM, 2021
-
Revisiting Recommended BGP Route Flap Damping ConfigurationsIn: Proc. of Network Traffic Measurement and Analysis Conference (TMA), IFIP, 2021
-
On the Deployment of Default Routes in Inter-domain RoutingIn: Proc. of ACM SIGCOMM Workshop on Technologies, Applications, and Uses of a Responsible Internet (TAURIN'21), pp. 14–20, ACM, 2021
-
Revisiting RPKI Route Origin Validation on the Data PlaneIn: Proc. of Network Traffic Measurement and Analysis Conference (TMA), IFIP, 2021
-
Security of Alerting Authorities in the WWW: Measuring Namespaces, DNSSEC, and Web PKIIn: Proc. of 30th The Web Conference (WWW), pp. 2709–2720, ACM, 2021
-
From the Beginning: Key Transitions in the First 15 Years of DNSSECTechnical Report arXiv:2109.08783, Open Archive: arXiv.org, 2021
-
On Measuring RPKI Relying PartiesIn: Proc. of ACM Internet Measurement Conference (IMC), pp. 484–491, ACM, 2020
-
BGP Beacons, Network Tomography, and Bayesian Computation to Locate Route Flap DampingIn: Proc. of ACM Internet Measurement Conference (IMC), pp. 492–505, ACM, 2020
-
Uncovering Vulnerable Industrial Control Systems from the Internet CoreIn: Proc. of 17th IEEE/IFIP Network Operations and Management Symposium (NOMS), IEEE Press, 2020
-
Who ya gonna call? (Alerting Authorities): Measuring Namespaces, Web Certificates, and DNSSECTechnical Report arXiv:2008.10497, Open Archive: arXiv.org, 2020
-
Down the Black Hole: Dismantling Operational Practices of BGP Blackholing at IXPsIn: Proc. of ACM Internet Measurement Conference (IMC), pp. 435–448, ACM, 2019
-
A Reproducibility Study of “IP Spoofing Detection in Inter-Domain Traffic”Technical Report arXiv:1911.05164, Open Archive: arXiv.org, 2019
-
Uncovering Vulnerable Industrial Control Systems from the Internet CoreTechnical Report arXiv:1901.04411, Open Archive: arXiv.org, 2019
-
★ Best of SIGCOMM CCRThe Dagstuhl Beginners Guide to Reproducibility for Experimental Networking ResearchACM SIGCOMM Computer Communication Review, 49(1), pp. 24–30, 2019Editorial note
-
★ Best of ACM SIGCOMM CCRTowards a Rigorous Methodology for Measuring Adoption of RPKI Route Validation and FilteringACM SIGCOMM Computer Communication Review, 48(1), pp. 19–27, 2018
-
The Rise of Certificate Transparency and Its Implications on the Internet EcosystemIn: Proc. of ACM Internet Measurement Conference (IMC), pp. 343–349, ACM, 2018
-
On the Potential of BGP Flowspec for DDoS Mitigation at Two Sources: ISP and IXPIn: Proc. of ACM SIGCOMM. Poster Session, pp. 57–59, ACM, 2018
-
A Survey on Artifacts from CoNEXT, ICN, IMC, and SIGCOMM Conferences in 2017ACM SIGCOMM Computer Communication Review, 48(1), pp. 75–80, 2018Editorial note
-
Towards a Rigorous Methodology for Measuring Adoption of RPKI Route Validation and FilteringTechnical Report arXiv:1706.04263, Open Archive: arXiv.org, 2017
-
Towards Better Internet Citizenship: Reducing the Footprint of Internet-wide Scans by Topology Aware Prefix SelectionIn: Proc. of ACM Internet Measurement Conference (IMC), pp. 421–427, ACM, 2016
-
Measuring and Implementing Internet Backbone Security: Current Challenges, Upcoming Deployment, and Future TrendsPh.D. thesis, Department of Mathematics and Computer Science, Freie Universität Berlin, 2016
-
A Survey on Honeypot Software and Data AnalysisTechnical Report arXiv:1608.06249, Open Archive: arXiv.org, 2016
-
Towards Better Internet Citizenship: Reducing the Footprint of Internet-wide Scans by Topology Aware Prefix SelectionTechnical Report arXiv:1605.05856, Open Archive: arXiv.org, 2016
-
CAIR: Using Formal Languages to Study Routing, Leaking, and Interception in BGPTechnical Report arXiv:1605.00618, Open Archive: arXiv.org, 2016
-
RiPKI: The Tragic Story of RPKI Deployment in the Web EcosystemIn: Proc. of Fourteenth ACM Workshop on Hot Topics in Networks (HotNets), ACM, 2015
-
Cashing out the Great Cannon? On Browser-Based DDoS Attacks and EconomicsIn: Proc. of 9th USENIX Security Workshop on Offensive Technologies (WOOT), USENIX Assoc., 2015
-
See How ISPs Care: An RPKI Validation Extension for Web BrowsersIn: Proc. of ACM SIGCOMM, Demo Session, pp. 115–116, ACM, 2015
-
RPKI MIRO: Monitoring and Inspection of RPKI ObjectsIn: Proc. of ACM SIGCOMM, Demo Session, pp. 107–108, ACM, 2015
-
The Abandoned Side of the Internet: Hijacking Internet Resources When Domain Names ExpireIn: Proc. of 7th International Workshop on Traffic Monitoring and Analysis (TMA), pp. 188–201, Springer-Verlag, 2015
-
Amplification and DRDoS Attack Defense – A Survey and New PerspectivesTechnical Report arXiv:1505.07892, Open Archive: arXiv.org, 2015
-
The Abandoned Side of the Internet: Hijacking Internet Resources When Domain Names ExpireTechnical Report arXiv:1412.5052, Open Archive: arXiv.org, 2014
-
When BGP Security Meets Content Deployment: Measuring and Analysing RPKI-Protection of WebsitesTechnical Report arXiv:1408.0391, Open Archive: arXiv.org, 2014
-
The Critical Internet Infrastructure (Dagstuhl Seminar 13322)The Critical Internet Infrastructure (Dagstuhl Seminar 13322), Schloss Dagstuhl–Leibniz-Zentrum fuer Informatik, 2013
-
A Scalable Communication Infrastructure for Smart Grid Applications using Multicast over Public NetworksIn: Proc. of ACM Symposium on Applied Computing (SAC'13), pp. 690–692, ACM, 2013
-
Design, Implementation, and Operation of a Mobile HoneypotTechnical Report arXiv:1301.7257, Open Archive: arXiv.org, 2013
-
Exploring Reachability via Settlement-Free PeeringIn: Proc. of the ACM SIGCOMM CoNEXT. Student Workshop, pp. 49–50, ACM, 2012
-
First Insights from a Mobile HoneypotIn: Proc. of ACM SIGCOMM. Poster, pp. 305–306, ACM, 2012
-
Exposing a Nation-Centric View on the German Internet – A Change in Perspective on the AS LevelIn: Proc. of the 13th Passive and Active Measurement Conference (PAM), pp. 200-210, Springer, 2012
-
Ein Routing-Atlas für die strukturelle und visuelle Exposition des deutschen InternetsPraxis der Informationsverarbeitung und Kommunikation (PIK), 34(2), pp. 60–72, 2011
-
Modeling the Network TopologyIn: Modeling and Tools for Network Simulation (Klaus Wehrle, Mesut Günes, James Gross, Eds.), pp. 471–486, Springer, 2010
-
Modeling the Internet Delay Space and its Application in Large Scale P2P SimulationIn: Modeling and Tools for Network Simulation (Klaus Wehrle, Mesut Günes, James Gross, Eds.), pp. 427–446, Springer, 2010
-
A Framework for Nation-Centric Classification and Observation of the InternetIn: Proc. of the 6th ACM SIGCOMM International Conference on emerging Networking EXperiments and Technologies (CoNEXT'10). Student Workshop, ACM, 2010
-
Towards a Nation-Centric Understanding of the InternetIn: Proc. of the 6th ACM SIGCOMM International Conference on emerging Networking EXperiments and Technologies (CoNEXT'10). Student Workshop, ACM, 2010
-
The Character of G-LAB – An Analysis of the German Lab for Future Internet Research and its Opportunities for Experimentally Driven Service DevelopmentIn: Proceedings of the TERENA Networking Conference (TNC 2010), TERENA, 2010
-
Peer the Peers: An Overlay ID Assignment Service at Internet Exchange PointsIn: Proc. of the 5th ACM SIGCOMM International Conference on emerging Networking EXperiments and Technologies (CoNEXT'09). Student Workshop, pp. 45–46, ACM, 2009
-
What is happening from behind?: Making the impact of Internet topology visibleCampus-Wide Information Systems, 25(5), pp. 392–406, 2008Special issue, selected papers from the TERENA networking conference 2008
-
What is Happening from Behind? – Making the Impact of Internet Topology VisibleIn: Proceedings of the TERENA Networking Conference (TNC 2008), TERENA, Amsterdam, 2008
-
Exploring the Routing Complexity of Mobile Multicast – A Semi-empirical StudyIn: Proceedings of 2007 ACM CoNEXT Conference. Student Workshop, ACM, 2007
-
On the Correlation of Geographic and Network Proximity at Internet Edges and its Implications for Mobile Unicast and Multicast RoutingIn: Proceedings of the IEEE ICN'07, IEEE Computer Society Press, 2007