Beyond Counting

Abstract

In this study, we report on techniques and analyses that enable us to capture Internet-wide activity at individual IP addresslevel granularity by relying on server logs of a large commercial content delivery network (CDN) that serves close to 3 trillion HTTP requests on a daily basis. Across the whole of 2015, these logs recorded client activity involving 1.2 billion unique IPv4 addresses, the highest ever measured, in agreement with recent estimates. Monthly client IPv4 address counts showed constant growth for years prior, but since 2014, the IPv4 count has stagnated while IPv6 counts have grown. Thus, it seems we have entered an era marked by increased complexity, one in which the sole enumeration of active IPv4 addresses is of little use to characterize recent growth of the Internet as a whole.With this observation in mind, we consider new points of view in the study of global IPv4 address activity. Our analysis shows significant churn in active IPv4 addresses: the set of active IPv4 addresses varies by as much as 25% over the course of a year. Second, by looking across the active addresses in a prefix, we are able to identify and attribute activity patterns to network restructurings, user behaviors, and, in particular, various address assignment practices. Third, by combining spatio-temporal measures of address utilization with measures of traffic volume, and sampling-based estimates of relative host counts, we present novel perspectives on worldwide IPv4 address activity, including empirical observation of under-utilization in some areas, and complete utilization, or exhaustion, in others.

Millions of targets under attack

“…Together, our data sets of attack events account for 20.90 M attacks, targeting 6.34 M unique IP addresses, over a two-year period (Table 1). We observe a total of 2.19 M unique /24 network blocks that host at least one target, which is about a third of the ∼6.5 M /24 blocks recently estimated to be active on the Internet [8,9]. For repeated attacks against the same IP address, we see fewer events per target IP in the honeypots data than in the telescope data, which we attribute to more followup in randomly spoofed attacks.…”

“…We use two raw data sources that provide signals of DoS attack events and complement each other: (1) the UCSD Network Telescope [6], which captures evidence of DoS attacks that involve randomly and uniformly spoofed IP addresses; and (2) the AmpPot DDoS honeypots [7], which witness reflection and amplification DoS attacks -an attack type that involves specifically spoofed IP addresses. Our data sets reveal more than 20 M DoS attacks targeting about 2.2 M /24 IPv4 network blocks, which is more than one-third of those estimated to be active on the Internet [8,9]. Furthermore, we discover 137 k cases where both randomly spoofed attacks and reflection and amplification attacks were simultaneously launched against the same target.…”

“…We show in Figure 8 per protocol the top five potentially targeted services, along with their share of the distribution within that respective protocol. 9 Table 8a shows the results for TCP. HTTP ranks first with 2.83 M attack events, which account for 48.68% of 5.81 M single target port attacks on TCP.…”

DDoS Mitigation: A Measurement-Based Approach

“…Together, our data sets of attack events account for 20.90 M attacks, targeting 6.34 M unique IP addresses, over a two-year period (Table 3.1). We observe a total of 2.19 M unique /24 network blocks that host at least one target, which is about a third of the ∼6.5 M /24 blocks recently estimated to be active on the Internet [95,117]. For repeated attacks against the same IP address, we see fewer events per target IP in the AmpPot data than in the UCSD-NT data, which we attribute to more follow-up in randomly spoofed attacks.…”

On the Origin of Scanning

“…Fast IPv4 scanning has become a standard measurement technique for understanding edge host behavior on the Internet. Popularized by tools like ZMap [22] and Masscan [24], Internet scanning has enabled hundreds of papers on service deployment [4,18,20,31,53,57], outages [9,16,22,32,33,47,55], host liveness [7,12,27,46,56], security weaknesses [14,45,60], operator behavior [3,19,21,23,41], botnets [5,39], and censorship [34,49,50], as well as helped uncover new vulnerabilities [6,8,13,29]. Yet, despite the technique's recent popularity, there has been relatively little analysis of its accuracy and completeness.…”