Defining and Evaluating Greynets (Sparse Darknets)

Abstract

Darknets are increasingly being proposed as a means by which network administrators can monitor for anomalous, externally sourced traffic. Current darknet designs require large, contiguous blocks of unused IP addresses -not always feasible for enterprise network operators. In this paper we introduce, define and evaluate the concept of a Greynet -a region of IP address space that is sparsely populated with 'darknet' addresses interspersed with active (or 'lit') IP addresses. We use raw traffic traces collected within a university network to evaluate how sparseness affects a greynet's effectiveness and hence show that enterprise operators can achieve useful levels of network scan detection, with only small numbers of 'dark' IP addresses making up their greynets.

Understanding IPv6 internet background radiation

“…For instance, Bailey, et al and Cooke, et al have shown that, with an IPv4 network telescope, much more data is gathered when it is located near live hosts [4,8]. Likewise, Harrop et al discuss, in the context of enterprise IPv4 networks, the advantages of greynets, which have unused addresses interspersed with live addresses to produce visibility similar to that of a large, contiguous network telescope [17]. Since the IPv6 address space is vast, compared to IPv4, (and, consequently, sparse) this locality advantage is even more necessary to capture a network telescope sample of any meaningful size.…”

DANTE: A framework for mining and monitoring darknet traffic

“…Therefore, we demonstrate the usefulness of the proposed approach through a case study on over a year of data. The data was collected from a greynet [37], [7], meaning that the unused IPs are from a network that is populated by both active and unused IP addresses.…”

Real-time collaborative network monitoring and control using 3D game engines for representation and interaction

“…Greynets [35,36] modify the darknet concept by monitoring unused IP addresses diffused amongst 'normal' active IP addresses in an operational enterprise network. Detecting worm scans within an enterprise network is particularly useful for detecting and tracking worms that have taken up residence on 'trusted' hosts inside the enterprise's boundaries.…”

“…In recent times, people have explored the use of darknets 1 [41] and greynets [35] to passively monitor for the tell-tale signs of network scans in progress. In this paper we make use of the greynet to provide passively collected network intrusion information.…”