Alexander Darer

Oliver Farnan, Alexander Darer, Joss Wright

Anecdotal evidence suggests an increasing number of people are turning to VPN services for the properties of privacy, anonymity and free communication over the internet. Despite this, there is little research into what these services are actually being used for. We use DNS cache snooping to determine what domains people are accessing through VPNs. This technique is used to discover whether certain queries have been made against a particular DNS server. Some VPNs operate their own DNS servers, ensuring that any cached queries were made by users of the VPN. We explore 3 methods of DNS cache snooping and briefly discuss their strengths and limitations. Using the most reliable of the methods, we perform a DNS cache snooping scan against the DNS servers of several major VPN providers. With this we discover which domains are actually accessed through VPNs. We run this technique against popular domains, as well as those known to be censored in certain countries; China, Indonesia, Iran, and Turkey. Our work gives a glimpse into what users use VPNs for, and provides a technique for discovering the frequency with which domain records are accessed on a DNS server.

Joss Wright, Alexander Darer, Oliver Farnan

We develop a means to detect ongoing per-country anomalies in the daily usage metrics of the Tor anonymous communication network, and demonstrate the applicability of this technique to identifying likely periods of internet censorship and related events. The presented approach identifies contiguous anomalous periods, rather than daily spikes or drops, and allows anomalies to be ranked according to deviation from expected behaviour. The developed method is implemented as a running tool, with outputs published daily by mailing list. This list highlights per-country anomalous Tor usage, and produces a daily ranking of countries according to the level of detected anomalous behaviour. This list has been active since August 2016, and is in use by a number of individuals, academics, and NGOs as an early warning system for potential censorship events. We focus on Tor, however the presented approach is more generally applicable to usage data of other services, both individually and in combination. We demonstrate that combining multiple data sources allows more specific identification of likely Tor blocking events. We demonstrate the our approach in comparison to existing anomaly detection tools, and against both known historical internet censorship events and synthetic datasets. Finally, we detail a number of significant recent anomalous events and behaviours identified by our tool.

Alexander Darer, Peter Lewis

Video games can be used as an excellent test bed for Artificial Intelligence (AI) techniques. They are challenging and non-deterministic, this makes it very difficult to write strong AI players. An example of such a video game is Ms. Pac-Man. In this paper we will outline some of the previous techniques used to build AI controllers for Ms. Pac-Man as well as presenting a new and novel solution. My technique utilises a Cellular Automaton (CA) to build a representation of the environment at each time step of the game. The basis of the representation is a 2-D grid of cells. Each cell has a state and a set of rules which determine whether or not that cell will dominate (i.e. pass its state value onto) adjacent cells at each update. Once a certain number of update iterations have been completed, the CA represents the state of the environment in the game, the goals and the dangers. At this point, Ms. Pac-Man will decide her next move based only on her adjacent cells, that is to say, she has no knowledge of the state of the environment as a whole, she will simply follow the strongest path. This technique shows promise and allows the controller to achieve high scores in a live game, the behaviour it exhibits is interesting and complex. Moreover, this behaviour is produced by using very simple rules which are applied many times to each cell in the grid. Simple local interactions with complex global results are truly achieved.