Darknet Traffic Analysis and Classification Using Numerical AGM and Mean Shift Clustering Algorithm

Abstract

The cyberspace continues to evolve more complex than ever anticipated, and same is the case with security dynamics there. As our dependence on cyberspace is increasing day-by-day, regular and systematic monitoring of cyberspace security has become very essential. A darknet is one such monitoring framework for deducing malicious activities and the attack patterns in the cyberspace. Darknet traffic is the spurious traffic observed in the empty address space, i.e., a set of globally valid Internet Protocol (IP) addresses which are not assigned to any hosts or devices. In an ideal secure network system, no traffic is expected to arrive on such a darknet IP space. However, in reality, noticeable amount of traffic is observed in this space primarily due to the Internet wide malicious activities, attacks and sometimes due to the network level misconfigurations. Analyzing such traffic and finding distinct attack patterns present in them can be a potential mechanism to infer the attack trends in the real network. In this paper, the existing Basic and Extended AGgregate and Mode (AGM) data formats for darknet traffic analysis is studied and an efficient 29-tuple Numerical AGM data format suitable for analyzing the source IP address validated TCP connections (three-way handshake) is proposed to find attack patterns in this traffic using Mean Shift clustering algorithm. Analyzing the patterns detected from the clusters results in providing the traces of various attacks such as Mirai bot, SQL attack, and brute force. Analyzing the source IP validated TCP, darknet traffic is a potential technique in Cyber security to find the attack trends in the network.

Key Technology of the Medical Image Wise Mining Method Based on the Meanshift Algorithm

“…However, most hospitals currently deal with databases as low-end operations in medical databases, lacking data integration and analysis, not to mention medical decision-making and automatic acquisition of knowledge. A large amount of data are described as “rich data, but information is poor.” How to use data mining technology to find valuable knowledge and rules from these massive data is a problem that needs to be solved at present [ 15 , 16 ], and mining the hidden rules in the data to use them to provide scientific decisions for the diagnosis and treatment of diseases, summarizing various treatments. The efficacy of the program, better for hospital decision-making management, medical, scientific research, and teaching services, has become a very important research topic.…”

Darknet Traffic Analysis: A Systematic Literature Review

“…[35], [36], [17] Protocol-based Protocol-based traffic analysis Classified the protocols used in the darknet [37], [38] Behavior-based Attack prediction/detection Attack prediction or detection through analyzing traffic patterns [39], [40], [41], [42], [43], [44], [45],…”

Darknet traffic analysis, and classification system based on modified stacking ensemble learning algorithms

“…Niranjana et al ( 2020 ) described the data formats for darknet traffic analysis, including basic and extended AGgregate and mode (AGM). In particular, they shed light on the 29-tuple numerical AGM data format, which efficiently analyzes the source I.P.…”