Toward understanding distributed blackhole placement

Abstract

The monitoring of unused Internet address space has been shown to be an effective method for characterizing Internet threats including Internet worms and DDOS attacks. Because there are no legitimate hosts in an unused address block, traffic must be the result of misconfiguration, backscatter from spoofed source addresses, or scanning from worms and other probing. This paper extends previous work characterizing traffic seen at specific unused address blocks by examining differences observed between these blocks. While past research has attempted to extrapolate the results from a small number of blocks to represent global Internet traffic, we present evidence that distributed address blocks observe dramatically different traffic patterns. This work uses a network of blackhole sensors which are part of the Internet Motion Sensor (IMS) collection infrastructure. These sensors are deployed in networks belonging to service providers, large enterprises, and academic institutions representing a diverse sample of the IPv4 address space. We demonstrate differences in traffic observed along three dimensions: over all protocols and services, over a specific protocol and service, and over a particular worm signature. This evidence is then combined with additional experimentation to build a list of sensor properties providing plausible explanations for these differences. Using these properties, we conclude with recommendations for better understanding the implications of sensor placement.

A Survey on Honeypot Technology : Concepts, Types and Working

“…So there are high chances for collecting large amounts of information, as all actions can be logged and analyzed. Any error in the system may allow a hacker to control the full operating system, attack other systems, or intercept messages in the application system [14].…”

SGNET: A Worldwide Deployable Framework to Support the Analysis of Malware Threat Models

“…The SGNET deployment aims at monitoring small sets of IPs deployed in multiple locations of the IP space, in order to characterize the heterogeneity of the activities along the Internet as observed in [14,9]. SGNET sensors are thus low-end hosts meant to be deployed at low cost by different organizations and bound to a limited number of IPs.…”

“…An extremely valid instrument to collect information is the honeypot technology. The deployment of honeypots in several locations of the IP space has underlined the fact that different blocks of addresses are attacked differently [14,9]. It is thus extremely important to have in-depth information about these threats in order to study the feasibility of characterizing the different observed segments of the Internet.…”

New Approaches for Security, Privacy and Trust in Complex Environments

“…Preventive mechanisms by identification of the activities and infiltration of the botnets to stop their operations, are proposed. In [16], an overview of the origins and structure of botnets is presented. It used data from the Internet Motion Sensor project [17] and Honeypot [18] to demonstrate the dangers of botnets due to their increase in number and their ability to exploit common system vulnerabilities such as the DCOM RPC [19] and LSASS [20].…”