Clairvoyance: Inferring Blocklist Use on the Internet

Li, Vector Guo; Akiwate, Gautam; Levchenko, Kirill; Voelker, Geoffrey M.; Savage, Stefan

doi:10.1007/978-3-030-72582-2_4

Cited by 3 publications

(3 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Oliver et al [122] investigated the usage patterns of 712 prefixes from Spamhaus' "Don't Route or Peer" (DROP) list [160], which operators frequently use to identify maliciously used address space. They found that for 32% of prefixes' IRR entries were created a month before the prefixes were added to the blocklist, highlighting the fact that the IRR is not a reliable source for filtering information since it can be easily manipulated.…”

Section: As0 Roasmentioning

confidence: 99%

The Resource Public Key Infrastructure (RPKI): A Survey on Measurements and Future Prospects

Rodday,

Cunha,

Bush

et al. 2024

IEEE Trans. Netw. Serv. Manage.

View full text Add to dashboard Cite

The adoption of the Resource Public Key Infrastructure (RPKI) is increasing. To better understand and improve RPKI deployment, measuring route origin authorization (ROA) objects, RPKI route origin validation (ROV), and RPKI resilience is essential. In this paper, we survey RPKI-related research that aims to understand RPKI deployment. Additionally, we enrich our survey with many industry and IETF-related contributions.Our work provides an in-depth analysis of the many ideas and challenges discussed in studies of the RPKI ecosystem and includes lessons from mistakes made in the past, which we should avoid in the future.

show abstract

Section: As0 Roasmentioning

confidence: 99%

The Resource Public Key Infrastructure (RPKI): A Survey on Measurements and Future Prospects

Rodday,

Cunha,

Bush

et al. 2024

IEEE Trans. Netw. Serv. Manage.

View full text Add to dashboard Cite

show abstract

“…• Ensafi et al [16] made use of IP-ID variations to remotely detect censorship in a target country. In 2021, Li et al [8] used these IP-ID variations to confirm the IP blocklist used by the remote hosts.…”

Section: Background and Relevant Workmentioning

confidence: 99%

Telemetron: Measuring Network Capacity Between Off-Path Remote Hosts

Gosain

Jaiswal

Acharya

et al. 2021

2021 IEEE 46th Conference on Local Computer Networks (LCN)

View full text Add to dashboard Cite

This paper presents Telemetron, the first active bandwidth measurement tool that can estimate the path capacity between two remote hosts, from an off-path Measuring Machine (MM). It is possible to induce traffic flow between off-path remote hosts-sending request packets to one host, with a spoofed source IP, will cause the first host to send reply packets to the other. The challenge for MM is to measure the rate at which these packets arrive at the second machine. Our key observation is that if the second machine has a global IP-ID counter, the arrival of packets can be monitored remotely, using probes from MM. By observing the rate of increment in the global IP-ID counter, MM estimates the path capacity between remote hosts. Telemetron shows high accuracy; on average, the path capacity reported is 92.5% of the theoretical limit. 1 A recent conservative scan of the entire Internet by Salutari et al. [7], revealed ≈ 480, 000 machines with global IP-ID counters and Li et al. [8] identified 222, 782 global IP-ID hosts within the US, indicating that such points are not hard to find.

show abstract

“…The process of dark web pages retrieval starts with seeds URLs, then all dark web pages under the addresses are downloaded, followed by extracting hyperlinks from the downloaded pages and including them in the list of addresses, and lastly, each link is crawled into [24]. Dark web crawling is a process that is accompanied by many limitations due to the features of TOR network, particularly, unrelated websites, whereby there is weak connection between sites, thereby making it hard for the crawler to trail [25]. Previous studies have shown that dark websites that are hosted on private encrypted networks have link addresses with a shorter lifespan than those of websites found on the surface web [26].…”

Section: Introductionmentioning

confidence: 99%

Dark Web Illegal Activities Crawling and Classifying Using Data Mining Techniques

Alaidi

Al_airaji

Alrikabi

et al. 2022

Int. J. Interact. Mob. Technol.

View full text Add to dashboard Cite

Dark web is a canopy concept that denotes any kind of illicit activities carried out by anonymous persons or organizations, thereby making it difficult to trace. The illicit content on the dark web is constantly updated and changed. The collection and classification of such illegal activities are challenging tasks, as they are difficult and time-consuming. This problem has in recent times emerged as an issue that requires quick attention from both the industry and academia. To this end, efforts have been made in this article a crawler that is capable of collecting dark web pages, cleaning them, and saving them in a document database, is proposed. The crawler carries out an automatic classification of the gathered web pages into five classes. The classifiers used in classifying the pages include Linear Support Vector Classifier (SVC), Naïve Bayes (NB), and Document Frequency (TF-IDF). The experimental results revealed that an accuracy rate of 92% and 81% were achieved by SVC and NB, respectively.

show abstract

Clairvoyance: Inferring Blocklist Use on the Internet

Cited by 3 publications

References 18 publications

The Resource Public Key Infrastructure (RPKI): A Survey on Measurements and Future Prospects

The Resource Public Key Infrastructure (RPKI): A Survey on Measurements and Future Prospects

Telemetron: Measuring Network Capacity Between Off-Path Remote Hosts

Dark Web Illegal Activities Crawling and Classifying Using Data Mining Techniques

Contact Info

Product

Resources

About