From Uptime to Remediation Speed: Advancing DNS Abuse Mitigation Metrics

DNS abuse metrics have traditionally focused on capturing the incidence of abuse events. However, these metrics are primarily driven by the actions of attackers rather than the operators of the abused infrastructure. This paper explores time-based metrics to better measure actions of Internet intermediaries, with a particular focus on remediation timeliness. We present a systematic approach to understanding and applying time-based metrics, including uptime, persistence, and a newly proposed metric Remediation Speed (RS). By leveraging data from highly reputed reputation block lists (RBLs), we exemplify the computation of these metrics and discuss their respective advantages and limitations. Our findings highlight the importance of incorporating time-based elements to accurately reflect the effectiveness of DNS abuse mitigation efforts. Crucially, our study demonstrates that no single metric universally outperforms the others: the suitability of each metric depends on its intended application, making different metrics more appropriate for different purposes.