(Unintended) Consequences of export restrictions on medical goods during the Covid-19 pandemic

In the first half of 2020, several countries have responded to the challenges posed by the Covid-19 pandemic by restricting their export of medical supplies. Such measures are meant to increase the domestic availability of critical goods, and are commonly used in times of crisis. Yet, not much is known about their impact, especially on countries imposing them. Here we show that export bans are, by and large, counterproductive. Using a model of shock diffusion through the network of international trade, we simulate the impact of restrictions under different scenarios. We observe that while they would be beneficial to a country implementing them in isolation, their generalized use makes most countries worse off relative to a no-ban scenario. As a corollary, we estimate that prices increase in many countries imposing the restrictions. We also find that the cost of restraining from export bans is small, even when others continue to implement them. Finally, we document a change in countries position within the international trade network, suggesting that export bans have geopolitical implications.

Tracking and Characterizing Botnets Using Automatically Generated Domains

Modern botnets rely on domain-generation algorithms (DGAs) to build resilient command-and-control infrastructures. Recent works focus on recognizing automatically generated domains (AGDs) from DNS traffic, which potentially allows to identify previously unknown AGDs to hinder or disrupt botnets communication capabilities. The state-of-the-art approaches require to deploy low-level DNS sensors to access data whose collection poses practical and privacy issues, making their adoption problematic. We propose a mechanism that overcomes the above limitations by analyzing DNS traffic data through a combination of linguistic and IP-based features of suspicious domains. In this way, we are able to identify AGD names, characterize their DGAs and isolate logical groups of domains that represent the respective botnets. Moreover, our system enriches these groups with new, previously unknown AGD names, and produce novel knowledge about the evolving behavior of each tracked botnet. We used our system in real-world settings, to help researchers that requested intelligence on suspicious domains and were able to label them as belonging to the correct botnet automatically. Additionally, we ran an evaluation on 1,153,516 domains, including AGDs from both modern (e.g., Bamital) and traditional (e.g., Conficker, Torpig) botnets. Our approach correctly isolated families of AGDs that belonged to distinct DGAs, and set automatically generated from non-automatically generated domains apart in 94.8 percent of the cases.