CAREER: Debugging the Fragmented DNS Infrastructure at Scale

域名系统（DNS）是最关键的互联网基础设施之一。它支持几乎所有的互联网活动，将用户友好的名称（如www.google.com）转换为计算机友好的IP地址。虽然在其蓝图中被设计为高度可靠的基础设施，但DNS故障并不罕见，有时甚至导致一个国家的网络中断。调试DNS故障无疑是重要的，但也具有挑战性。虽然DNS可以被看作是一个分布式系统，但它是开放式的、碎片化的，包含许多服务提供商，并受到强大的网络对手的干扰。虽然DNS的基本逻辑在概念上很简单，但它的实现在客户端设备上是高度定制的，并且DNS错误可能由代码和非代码资源之间的复杂交互引起。这些独特的设置使DNS故障和错误变得复杂且难以诊断。该项目旨在开发新的平台、技术和工具，以实现DNS基础设施的整体调试。这项工作是通过两个研究重点来组织的：在网络层调试DNS故障，在软件层调试客户端DNS错误。对于第一个要点，将首先通过使用DMiner（一种由自然语言处理（NLP）技术提供支持的工具）挖掘公共文本来创建对现实世界DNS故障和错误的全面参考。为了重现DNS故障，将开发一种新的测量平台DTrap+，该平台将创新地使用点对点代理来众包调试任务。为了实现跨层和对抗弹性的DNS调试，将开发端到端DNS跟踪框架DTrace和安全跟踪协议DARTrace。第二个重点是物联网（IoT）设备中嵌入的DNS漏洞。DNS实现将使用DFirm从物联网固件中提取，DFirm是一种由符号执行和库匹配驱动的工具。DNS漏洞将由DScope发现，DScope是一个对DNS实现实施多组件分析的工具。拟建项目将在以下方面产生重大的社会影响：第一，为互联网用户提供可靠的网络服务是互联网社区的核心使命之一。通过对DNS服务和客户端进行有效的故障发现和根本原因分析，该项目为这一使命做出了重要贡献。其次，通过一系列教育任务，该项目将为学生、研究人员、行业合作伙伴和公众普及DNS和一般网络调试。第三，该项目将通过UCI ASPIRE和OC STEM等项目优先考虑弱势群体的研究机会。在这个项目下开发的数据、代码和知识库将在dns-debug.github.io上发布。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Domain Name System (DNS) is one of the most critical Internet infrastructures. It underpins nearly every Internet activity, translating user-friendly names like www.google.com to computer-friendly IP addresses. Though designed as a highly reliable infrastructure in its blueprint, DNS failures are not rare, sometimes even leading to the network outage of a country. Debugging DNS failures is undoubtedly important but also challenging. Though DNS can be seen as a distributed system, it is open-ended and fragmented, containing numerous service providers and being interfered by powerful network adversaries. Though the basic logic of DNS is conceptually simple, its implementation is highly customized on the client-side devices and DNS bugs can be caused by the complex interactions between code and non-code resources. These unique settings make DNS failures and bugs complex and difficult to be diagnosed.This project is to develop novel platforms, techniques, and tools to enable holistic debugging for the DNS Infrastructure. This work is organized through two research thrusts: debugging DNS failures at the network layer, and debugging client-side DNS bugs at the software layer. For the first thrust, a comprehensive reference to the real-world DNS failures and bugs are to be created first by mining the public text with DMiner, a tool powered by Natural Language Processing (NLP) techniques. To reproduce a DNS failure, a new measurement platform, DTrap+, will be developed with innovative usage of peer-to-peer proxies to crowd-source the debugging tasks. To enable cross-layer and adversary-resilient debugging for DNS, DTrace, an end-to-end tracing framework for DNS, and DARTrace, a secured tracing protocol, will be developed. The second thrust focuses on the DNS bugs embedded in the Internet of Things (IoT) devices. The DNS implementations will be extracted from the IoT firmware with DFirm, a tool powered by symbolic execution and library matching. The DNS bugs will be uncovered by DScope, a tool enforcing multi-component analysis on the DNS implementations.The proposed project will have significant societal impacts in the following aspects. First, ensuring reliable network services for the Internet users is one core mission of the Internet community. By enabling effective fault discovery and root-cause analysis of DNS services and clients, this project makes an important contribution to this mission. Second, through a set of educational tasks, this project will democratize DNS and the general network debugging for students, researchers, industry partners, and the public. Third, this project will prioritize research opportunities for the underrepresented population through programs like UCI ASPIRE and OC STEM.The data, code, and knowledge base developed under this project will be released at dns-debug.github.io.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.