RIPE NCC DNS Measurements Hackathon

SIDN Labs' Giovane Moura, Moritz Müller and Jan Harm Kuipers were part of a team that earned an honorable mention by the jury of the RIPE NCC DNS Measurements Hackathon for their work on anomaly detection on authoritative DNS server traffic.

RIPE NCC organized a DNS measurement hackathon on April 20-21 in Amsterdam, an event that brought together topnotch engineers, researchers, designers, among others, to take up an internet measurement challenge and develop prototypes that benefit from the RIPE Atlas measurement network.

We, Giovane, Moritz and Jan Harm, together with colleagues from the University of Twente, Delft University of Technology, and VivaCell, formed the Schnabeltier/Anomalizers team. Our main goal was to develop a tool to detect anomalies on the Root DNS system, ccTLDs, and other DNS providers based on the RIPE Atlas measurements.

Hackathon 1

Team Schnabeltier (from left to right): Giovane Moura (SIDN Labs), Jan Harm Kuipers (SIDN Labs and University of Twente), Ricardo de Oliveira Schmidt (University of Twente), Christian Dörr (Delft University of Technology), Ella Titova (VivaCell) and Wouter de Vries (University of Twente). Not in the picture: Moritz Müller (SIDN Labs).

Building on the results and experience from our ACM IM2016 paper on the DDoS attacks on the Root DNS system, we used RIPE’s K-Root measurement datasets to evaluate the performance of three algorithms for anomaly detection on the reachability and performance of K-Root. We also showed how network paths and anycast catchments of RIPE Atlas probes change during DDoS attacks. Anomalies in these metrics can also indicate incidents on the Internet BGP hijacking.

The software that we developed during the hackathon to automate the download, analysis, and visualization of DNS measurement is publicly available on Github. We invite the readers of this blog to follow our presentation and check out our demo.

Hackathon 2

Overall, we look back on a great event that provided us with the opportunity to develop a tool that can be used not only at SIDN, but also any cc/gTLD service provider that is monitored by the RIPE Atlas platform. The hackathon was also  a great chance to network and to learn from other inspiring hackathon projects. Thanks to RIPE NCC and the sponsors for organizing this awesome event. We’ll definitely be back next year!


  • Wednesday 25 July 2018


    How is IPv6 support measured for the Registrar Scorecard?


    How we go about it

    Read more
  • Monday 23 April 2018


    SIDN on campus


    Cristian Hesselman to teach Security Services for the Internet of Things.

    Read more
  • Tuesday 26 February 2019


    SIDN under supervision of Radiocommunications Agency


    How we became an 'operator of essential services'

    Read more


Your browser is too old to optimally experience this website. Upgrade your browser to improve your experience.