Increasing the darkness of darknet traffic

Yumehisa Haga, Akira Saso, Tatsuya Mori, Shigeki Goto

    Research output: Chapter in Book/Report/Conference proceedingConference contribution

    Abstract

    A Darknet is a passive sensor system that monitors traffic routed to unused IP address space. Darknets have been widely used as tools to detect malicious activities such as propagating worms, thanks to the useful feature that most packets observed by a darknet can be assumed to have originated from non-legitimate hosts. Recent commoditization of Internet-scale survey traffic originating from legitimate hosts could overwhelm the traffic that was originally supposed to be monitored with a darknet. Based on this observation, we posed the following research question: »Can the Internet-scale survey traffic become noise when we analyze darknet traffic?» To answer this question, we propose a novel framework, ID2, to increase the darkness of darknet traffic, i.e., ID2 discriminates between Internet-scale survey traffic originating from legitimate hosts and other traffic potentially associated with malicious activities. It leverages two inrinsic characteristics of Internet-scale survey traffic: a network- level property and some form of footprint explicitly indicated by surveyors. When we analyzed darknet traffic using ID2, we saw that Internet-scale traffic can be noise. We also demonstrated that the discrimination of survey traffic exposes hidden traffic anomalies, which are invisible without using our technique.

    Original languageEnglish
    Title of host publication2015 IEEE Global Communications Conference, GLOBECOM 2015
    PublisherInstitute of Electrical and Electronics Engineers Inc.
    ISBN (Print)9781479959525
    DOIs
    Publication statusPublished - 2016 Feb 23
    Event58th IEEE Global Communications Conference, GLOBECOM 2015 - San Diego, United States
    Duration: 2015 Dec 62015 Dec 10

    Other

    Other58th IEEE Global Communications Conference, GLOBECOM 2015
    CountryUnited States
    CitySan Diego
    Period15/12/615/12/10

    Fingerprint

    Traffic surveys
    Internet
    traffic
    Sensors

    ASJC Scopus subject areas

    • Computer Networks and Communications
    • Electrical and Electronic Engineering
    • Communication

    Cite this

    Haga, Y., Saso, A., Mori, T., & Goto, S. (2016). Increasing the darkness of darknet traffic. In 2015 IEEE Global Communications Conference, GLOBECOM 2015 [7416973] Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/GLOCOM.2014.7416973

    Increasing the darkness of darknet traffic. / Haga, Yumehisa; Saso, Akira; Mori, Tatsuya; Goto, Shigeki.

    2015 IEEE Global Communications Conference, GLOBECOM 2015. Institute of Electrical and Electronics Engineers Inc., 2016. 7416973.

    Research output: Chapter in Book/Report/Conference proceedingConference contribution

    Haga, Y, Saso, A, Mori, T & Goto, S 2016, Increasing the darkness of darknet traffic. in 2015 IEEE Global Communications Conference, GLOBECOM 2015., 7416973, Institute of Electrical and Electronics Engineers Inc., 58th IEEE Global Communications Conference, GLOBECOM 2015, San Diego, United States, 15/12/6. https://doi.org/10.1109/GLOCOM.2014.7416973
    Haga Y, Saso A, Mori T, Goto S. Increasing the darkness of darknet traffic. In 2015 IEEE Global Communications Conference, GLOBECOM 2015. Institute of Electrical and Electronics Engineers Inc. 2016. 7416973 https://doi.org/10.1109/GLOCOM.2014.7416973
    Haga, Yumehisa ; Saso, Akira ; Mori, Tatsuya ; Goto, Shigeki. / Increasing the darkness of darknet traffic. 2015 IEEE Global Communications Conference, GLOBECOM 2015. Institute of Electrical and Electronics Engineers Inc., 2016.
    @inproceedings{ea811dd50ac748488a47ab497f54add7,
    title = "Increasing the darkness of darknet traffic",
    abstract = "A Darknet is a passive sensor system that monitors traffic routed to unused IP address space. Darknets have been widely used as tools to detect malicious activities such as propagating worms, thanks to the useful feature that most packets observed by a darknet can be assumed to have originated from non-legitimate hosts. Recent commoditization of Internet-scale survey traffic originating from legitimate hosts could overwhelm the traffic that was originally supposed to be monitored with a darknet. Based on this observation, we posed the following research question: »Can the Internet-scale survey traffic become noise when we analyze darknet traffic?» To answer this question, we propose a novel framework, ID2, to increase the darkness of darknet traffic, i.e., ID2 discriminates between Internet-scale survey traffic originating from legitimate hosts and other traffic potentially associated with malicious activities. It leverages two inrinsic characteristics of Internet-scale survey traffic: a network- level property and some form of footprint explicitly indicated by surveyors. When we analyzed darknet traffic using ID2, we saw that Internet-scale traffic can be noise. We also demonstrated that the discrimination of survey traffic exposes hidden traffic anomalies, which are invisible without using our technique.",
    author = "Yumehisa Haga and Akira Saso and Tatsuya Mori and Shigeki Goto",
    year = "2016",
    month = "2",
    day = "23",
    doi = "10.1109/GLOCOM.2014.7416973",
    language = "English",
    isbn = "9781479959525",
    booktitle = "2015 IEEE Global Communications Conference, GLOBECOM 2015",
    publisher = "Institute of Electrical and Electronics Engineers Inc.",

    }

    TY - GEN

    T1 - Increasing the darkness of darknet traffic

    AU - Haga, Yumehisa

    AU - Saso, Akira

    AU - Mori, Tatsuya

    AU - Goto, Shigeki

    PY - 2016/2/23

    Y1 - 2016/2/23

    N2 - A Darknet is a passive sensor system that monitors traffic routed to unused IP address space. Darknets have been widely used as tools to detect malicious activities such as propagating worms, thanks to the useful feature that most packets observed by a darknet can be assumed to have originated from non-legitimate hosts. Recent commoditization of Internet-scale survey traffic originating from legitimate hosts could overwhelm the traffic that was originally supposed to be monitored with a darknet. Based on this observation, we posed the following research question: »Can the Internet-scale survey traffic become noise when we analyze darknet traffic?» To answer this question, we propose a novel framework, ID2, to increase the darkness of darknet traffic, i.e., ID2 discriminates between Internet-scale survey traffic originating from legitimate hosts and other traffic potentially associated with malicious activities. It leverages two inrinsic characteristics of Internet-scale survey traffic: a network- level property and some form of footprint explicitly indicated by surveyors. When we analyzed darknet traffic using ID2, we saw that Internet-scale traffic can be noise. We also demonstrated that the discrimination of survey traffic exposes hidden traffic anomalies, which are invisible without using our technique.

    AB - A Darknet is a passive sensor system that monitors traffic routed to unused IP address space. Darknets have been widely used as tools to detect malicious activities such as propagating worms, thanks to the useful feature that most packets observed by a darknet can be assumed to have originated from non-legitimate hosts. Recent commoditization of Internet-scale survey traffic originating from legitimate hosts could overwhelm the traffic that was originally supposed to be monitored with a darknet. Based on this observation, we posed the following research question: »Can the Internet-scale survey traffic become noise when we analyze darknet traffic?» To answer this question, we propose a novel framework, ID2, to increase the darkness of darknet traffic, i.e., ID2 discriminates between Internet-scale survey traffic originating from legitimate hosts and other traffic potentially associated with malicious activities. It leverages two inrinsic characteristics of Internet-scale survey traffic: a network- level property and some form of footprint explicitly indicated by surveyors. When we analyzed darknet traffic using ID2, we saw that Internet-scale traffic can be noise. We also demonstrated that the discrimination of survey traffic exposes hidden traffic anomalies, which are invisible without using our technique.

    UR - http://www.scopus.com/inward/record.url?scp=84964874863&partnerID=8YFLogxK

    UR - http://www.scopus.com/inward/citedby.url?scp=84964874863&partnerID=8YFLogxK

    U2 - 10.1109/GLOCOM.2014.7416973

    DO - 10.1109/GLOCOM.2014.7416973

    M3 - Conference contribution

    SN - 9781479959525

    BT - 2015 IEEE Global Communications Conference, GLOBECOM 2015

    PB - Institute of Electrical and Electronics Engineers Inc.

    ER -