Characteristics of internet background radiation
Proceedings of the 4th ACM SIGCOMM conference on Internet measurement
Toward understanding distributed blackhole placement
Proceedings of the 2004 ACM workshop on Rapid malcode
Inferring Internet denial-of-service activity
ACM Transactions on Computer Systems (TOCS)
Passive measurement of one-way and two-way flow lifetimes
ACM SIGCOMM Computer Communication Review
Internet background radiation revisited
IMC '10 Proceedings of the 10th ACM SIGCOMM conference on Internet measurement
A network activity classification schema and its application to scan detection
IEEE/ACM Transactions on Networking (TON)
Classifying internet one-way traffic
Proceedings of the 2012 ACM conference on Internet measurement conference
The day after patch tuesday: effects observable in IP darkspace traffic
PAM'13 Proceedings of the 14th international conference on Passive and Active Measurement
Understanding IPv6 internet background radiation
Proceedings of the 2013 conference on Internet measurement conference
| Hi-index | 0.00 |
During the last decade, unsolicited one-way Internet traffic has been used to study malicious activity on the Internet. Researchers usually observe such traffic using network telescopes deployed on darkspace (unused address space). When darkspace observations began ten years ago, one-way traffic was minimal. Over the last five years, however, traffic levels have risen so that they are now high enough to require more subtle differentiation --- raw packet and byte or even port counts make it hard to discern and distinguish new activities. To make changes in composition of one-way traffic aggregates more detectable, we have developed iatmon (Inter-Arrival Time Monitor), a freely available measurement and analysis tool that allows one to separate one-way traffic into clearly-defined subsets. Initially we have implemented two subsetting schemes; source types, based on the schema proposed in [12]; and inter-arrival-time (IAT) groups that summarise source behaviour over time. We use 14 types and 10 groups, giving us a matrix of 140 type+group subsets. Each subset constitutes only a fraction of the total traffic, so changes within the subsets are easily observable when changes in total traffic levels might not even be noticeable. We report on our experience with this tool to observe changes in one-way traffic at the UCSD network telescope over the first half of 2011. Daily average plots of source numbers and their traffic volumes show clear long-term changes in several of our types and groups.