Pattern Discovery in Internet Background Radiation

Iglesias, Félix; Zseby, Tanja

doi:10.1109/tbdata.2017.2723893

Cited by 11 publications

(14 citation statements)

References 43 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The AGM (AGgregation & Mode) vector was originally proposed for the exploration and discovery of patterns in the Internet Background Radiation [16]. Defined for unidirectional traffic, this vector captures the behavior of hosts by observing the use of eight lightweight flow features, plus the total number of packets.…”

Section: Agm Feature Vectormentioning

confidence: 99%

Analysis of Lightweight Feature Vectors for Attack Detection in Network Traffic

2018

Self Cite

View full text Add to dashboard Cite

The consolidation of encryption and big data in network communications have made deep packet inspection no longer feasible in large networks. Early attack detection requires feature vectors which are easy to extract, process, and analyze, allowing their generation also from encrypted traffic. So far, experts have selected features based on their intuition, previous research, or acritically assuming standards, but there is no general agreement about the features to use for attack detection in a broad scope. We compared five lightweight feature sets that have been proposed in the scientific literature for the last few years, and evaluated them with supervised machine learning. For our experiments, we use the UNSW-NB15 dataset, recently published as a new benchmark for network security. Results showed three remarkable findings: (1) Analysis based on source behavior instead of classic flow profiles is more effective for attack detection; (2) meta-studies on past research can be used to establish satisfactory benchmarks; and (3) features based on packet length are clearly determinant for capturing malicious activity. Our research showed that vectors currently used for attack detection are oversized, their accuracy and speed can be improved, and are to be adapted for dealing with encrypted traffic.

show abstract

Section: Agm Feature Vectormentioning

confidence: 99%

Analysis of Lightweight Feature Vectors for Attack Detection in Network Traffic

2018

Self Cite

View full text Add to dashboard Cite

show abstract

“…Iglesias and Zseby [3] proposed an efficient darknet traffic flow representation format called AGgregation and Mode (AGM) which is a 22-tuple representation and extended it to a 50-tuple format called Extended AGM to have numerical parameters. A 29-tuple Numerical AGM, extended from the 22-tuple AGM which is suitable to analyze the validated unsolicited TCP traffic is proposed in this paper.…”

Section: Literature Surveymentioning

confidence: 99%

“…Iglesias and Zseby [3] proposed a 22-feature vector AGM data format, suitable for darknet traffic analysis as shown in Listing 1. Each AGM corresponds to a particular source IP (srcIP_i) and it contains the aggregation and mode traffic The advantage of the AGM format is that the aggregation and mode fields of the source IP give a deep understanding and characterization of a particular source IP.…”

Section: Basic Agmmentioning

confidence: 99%

“…In Ref. [3], a 50-tuple Extended AGM format was proposed for applying the clustering algorithm on the darknet traffic data. Dummy variables were used by taking the top 1% of the field values into account.…”

Section: Basic Agmmentioning

confidence: 99%

“…Iglesias and Zseby [3] have applied consensual clustering algorithm to the AGM data format they proposed and recognized attack patterns in the/8 IPv4 CAIDA UCSD Network Telescope "Patch Tuesday" Dataset [4]. Similarly, in this research work, the attack trends and patterns has been found by applying clustering techniques to the darknet traffic by proposing a suitable and efficient 29-tuple data format specially designed for source IP addresses validated darknet traffic analysis.…”

Section: Introductionmentioning

confidence: 96%

See 2 more Smart Citations

Darknet Traffic Analysis and Classification Using Numerical AGM and Mean Shift Clustering Algorithm

2019

View full text Add to dashboard Cite

The cyberspace continues to evolve more complex than ever anticipated, and same is the case with security dynamics there. As our dependence on cyberspace is increasing day-by-day, regular and systematic monitoring of cyberspace security has become very essential. A darknet is one such monitoring framework for deducing malicious activities and the attack patterns in the cyberspace. Darknet traffic is the spurious traffic observed in the empty address space, i.e., a set of globally valid Internet Protocol (IP) addresses which are not assigned to any hosts or devices. In an ideal secure network system, no traffic is expected to arrive on such a darknet IP space. However, in reality, noticeable amount of traffic is observed in this space primarily due to the Internet wide malicious activities, attacks and sometimes due to the network level misconfigurations. Analyzing such traffic and finding distinct attack patterns present in them can be a potential mechanism to infer the attack trends in the real network. In this paper, the existing Basic and Extended AGgregate and Mode (AGM) data formats for darknet traffic analysis is studied and an efficient 29-tuple Numerical AGM data format suitable for analyzing the source IP address validated TCP connections (three-way handshake) is proposed to find attack patterns in this traffic using Mean Shift clustering algorithm. Analyzing the patterns detected from the clusters results in providing the traces of various attacks such as Mirai bot, SQL attack, and brute force. Analyzing the source IP validated TCP, darknet traffic is a potential technique in Cyber security to find the attack trends in the network.

show abstract