DANTE: A Framework for Mining and Monitoring Darknet Traffic

Cohen, Dvir; Mirsky, Yisroel; Kamp, Manuel; Martín, Tobías; Elovici, Yuval; Puzis, Rami; Shabtai, Asaf

doi:10.1007/978-3-030-58951-6_5

Cited by 16 publications

(19 citation statements)

References 28 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A common feature of router vulnerability types is that there are many cases wherein each router manufacturer's login screen was confirmed when an HTTP connection was made to the source hosts that sent the scan. Cohen et al [24] also identified that ports 5379, 6379, and 7379 were observed during the same period. Please refer to that previous paper for more details, including time-series graphs of the unique host counts of malware activities in this ground truth.…”

Section: A Details Of Datasetmentioning

confidence: 87%

“…2004: A spike of 300 hosts was observed on October 15 (window size=14600, 29200). 5379,6379,7379: Spikes of 1K hosts were observed on October 31 for each port [24].…”

Section: B Parameter Tuning In Dark-ntdmentioning

confidence: 99%

“…Clustering 2020 [24] Proposed a method for sequential clustering of attacking hosts having similar intentions by embedding port sequences for each source host.…”

Section: Anomalousmentioning

confidence: 99%

“…The authors discovered newly targeted ports and emerging IoT malware/botnets, highlighting their persistence and evolutionary process. Cohen et al proposed a method for sequential clustering of aggressive hosts having similar intentions from scalable darknet traffic by embedding a port sequence for each source host [24]. By tracking the clusters, they detected recurrent or new attacks and found several new campaigns of malicious port sequences.…”

Section: Anomalousmentioning

confidence: 99%

“…As mentioned in the previous subsection, DANTE [24] embeds port sequences of darknet traffic by source host in a given time frame and performs clustering. By comparing with the previous time frame and labeling the clusters, it is possible to track campaigns and detect recurrent or new attacks.…”

Section: Towards the Identification Of Investigative Scannersmentioning

confidence: 99%

See 4 more Smart Citations

Dark-TRACER: Early Detection Framework for Malware Activity Based on Anomalous Spatiotemporal Patterns

et al. 2022

View full text Add to dashboard Cite

As cyberattacks become increasingly prevalent globally, there is a need to identify trends in these cyberattacks and take suitable countermeasures quickly. The darknet, an unused IP address space, is relatively conducive to observing and analyzing indiscriminate cyberattacks because of the absence of legitimate communication. Indiscriminate scanning activities by malware to spread their infections often show similar spatiotemporal patterns, and such trends are also observed on the darknet. To address the problem of early detection of malware activities, we focus on anomalous synchronization of spatiotemporal patterns observed in darknet traffic data. Our previous studies proposed algorithms that automatically estimate and detect anomalous spatiotemporal patterns of darknet traffic in real time by employing three independent machine learning methods. In this study, we integrated the previously proposed methods into a single framework, which we refer to as Dark-TRACER, and conducted quantitative experiments to evaluate its ability to detect these malware activities. We used darknet traffic data from October 2018 to October 2020 observed in our largescale darknet sensors (up to /17 subnet scales). The results demonstrate that the weaknesses of the methods complement each other, and the proposed framework achieves an overall 100% recall rate. In addition, Dark-TRACER detects the average of malware activities 153.6 days earlier than when those malware activities are revealed to the public by reputable third-party security research organizations. Finally, we evaluated the cost of human analysis to implement the proposed system and demonstrated that two analysts can perform the daily operations necessary to operate the framework in approximately 7.3 h.

show abstract

Section: A Details Of Datasetmentioning

confidence: 87%

“…2004: A spike of 300 hosts was observed on October 15 (window size=14600, 29200). 5379,6379,7379: Spikes of 1K hosts were observed on October 31 for each port [24].…”

Section: B Parameter Tuning In Dark-ntdmentioning

confidence: 99%

“…Clustering 2020 [24] Proposed a method for sequential clustering of attacking hosts having similar intentions by embedding port sequences for each source host.…”

Section: Anomalousmentioning

confidence: 99%

Section: Anomalousmentioning

confidence: 99%

Section: Towards the Identification Of Investigative Scannersmentioning

confidence: 99%

See 3 more Smart Citations