Increasing the darkness of darknet traffic

Yumehisa Haga, Akira Saso, Tatsuya Mori, Shigeki Goto

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

A Darknet is a passive sensor system that monitors traffic routed to unused IP address space. Darknets have been widely used as tools to detect malicious activities such as propagating worms, thanks to the useful feature that most packets observed by a darknet can be assumed to have originated from non-legitimate hosts. Recent commoditization of Internet-scale survey traffic originating from legitimate hosts could overwhelm the traffic that was originally supposed to be monitored with a darknet. Based on this observation, we posed the following research question: »Can the Internet-scale survey traffic become noise when we analyze darknet traffic?» To answer this question, we propose a novel framework, ID2, to increase the darkness of darknet traffic, i.e., ID2 discriminates between Internet-scale survey traffic originating from legitimate hosts and other traffic potentially associated with malicious activities. It leverages two inrinsic characteristics of Internet-scale survey traffic: a network- level property and some form of footprint explicitly indicated by surveyors. When we analyzed darknet traffic using ID2, we saw that Internet-scale traffic can be noise. We also demonstrated that the discrimination of survey traffic exposes hidden traffic anomalies, which are invisible without using our technique.

Original languageEnglish
Title of host publication2015 IEEE Global Communications Conference, GLOBECOM 2015
PublisherInstitute of Electrical and Electronics Engineers Inc.
ISBN (Electronic)9781479959525
DOIs
Publication statusPublished - 2015
Event58th IEEE Global Communications Conference, GLOBECOM 2015 - San Diego, United States
Duration: 2015 Dec 62015 Dec 10

Publication series

Name2015 IEEE Global Communications Conference, GLOBECOM 2015

Other

Other58th IEEE Global Communications Conference, GLOBECOM 2015
CountryUnited States
CitySan Diego
Period15/12/615/12/10

ASJC Scopus subject areas

  • Computer Networks and Communications
  • Electrical and Electronic Engineering
  • Communication

Fingerprint Dive into the research topics of 'Increasing the darkness of darknet traffic'. Together they form a unique fingerprint.

Cite this