Extended darknet: Multi-dimensional internet threat monitoring system

Akihiro Shimoda*, Tatsuya Mori, Shigeki Goto

*この研究の対応する著者

研究成果: Article査読

3 被引用数 (Scopus)

抄録

Internet threats caused by botnets/worms are one of the most important security issues to be addressed. Darknet, also called a dark IP address space, is one of the best solutions for monitoring anomalous packets sent by malicious software. However, since darknet is deployed only on an inactive IP address space, it is an inefficient way for monitoring a working network that has a considerable number of active IP addresses. The present paper addresses this problem. We propose a scalable, lightweight malicious packet monitoring system based on a multi-dimensional IP/port analysis. Our system significantly extends the monitoring scope of darknet. In order to extend the capacity of darknet, our approach leverages the active IP address space without affecting legitimate traffic. Multidimensional monitoring enables the monitoring of TCP ports with firewalls enabled on each of the IP addresses. We focus on delays of TCP syn/ack responses in the traffic. We locate syn/ack delayed packets and forward them to sensors or honeypots for further analysis. We also propose a policy-based flow classification and forwarding mechanism and develop a prototype of a monitoring system that implements our proposed architecture. We deploy our system on a campus network and perform several experiments for the evaluation of our system. We verify that our system can cover 89% of the IP addresses while darknet-based monitoring only covers 46%. On our campus network, our system monitors twice as many IP addresses as darknet.

本文言語English
ページ(範囲)1915-1923
ページ数9
ジャーナルIEICE Transactions on Communications
E95-B
6
DOI
出版ステータスPublished - 2012 6月
外部発表はい

ASJC Scopus subject areas

  • ソフトウェア
  • コンピュータ ネットワークおよび通信
  • 電子工学および電気工学

フィンガープリント

「Extended darknet: Multi-dimensional internet threat monitoring system」の研究トピックを掘り下げます。これらがまとまってユニークなフィンガープリントを構成します。

引用スタイル