IBR (Internet Background Radiation) traffic identification is significant for malicious behavior detection. This paper presents a novel IBR traffic identification method since traditional methods depend on tough conditions, such as full bi-direction traffic or unassigned IP address space. We firstly explored the traffic source distribution of each destination IP on a traffic dataset, and found that the traffic sources of active IPs are relatively certain but that of inactive IPs are relatively uncertain. Secondly, based on this exploration results, we present a method to identify IBR traffic. It utilizes the presented metric to evaluate the certainty of traffic sources of a destination IP, so as to identify inactive IPs. Then it detects IBR traffic according to some heuristics built according to malicious traffic behavior patterns. We carried out several experiments to evaluate our method on real traffic datasets, and results show that it obtains 99% precision and 0.1% omission rate on detecting IPv4 IBR traffic. The detected IBR traffic includes the traffic that sent to assigned IPs besides unassigned IPs, which is more valuable and practical for detecting the malicious traffic in real networks.
M.Bailey, E.Cooke, F.Jahanian, J.Nazario and D.Watson, The Internet motion sensor: A distributed blackhole monitoring system, in: Proceedings of the 12th Network and Distributed System Security Symposium, February 2005, 2005.
2.
M.Bailey, E.Cooke, F.Jahanian, N.Provos, K.Rosaen and D.Watson, Data reduction for the scalable automated analysis of distributed darknet traffic, in: Proceedings of the USENIX/ACM Internet Measurement Conference, October 2005, 2005.
3.
K.Benson, A.Dainotti, K.C.Claffy and E.Aben, Gaining insight into AS-level outages through analysis of Internet background radiation, in: Proceedings of the 5th IEEE International Traffic Monitoring and Analysis Workshop, April 2013, 2013, pp. 447–452.
J.Czyz, K.Lady, S.G.Miller, M.Kallitsis and M.Karir, Understanding IPv6 Internet background radiation, in: Proceedings of the 13th ACM SIGCOMM Conference on Internet Measurement (IMC’13), October 2013, 2013, pp. 105–118.
6.
A.Dainotti, R.Ammann, E.Aben and K.C.Claffy, Extracting benefit from harm: Using malware pollution to analyze the impact of political and geophysical events on the Internet, ACM SIGCOMM Computer Communication Review42(1) (2012), 31–39.
7.
M.Drašar, M.Vizváry and J.Vykopal, Similarity as a central approach to flow-based anomaly detection, International Journal of Network Management24(4) (2014), 318–336.
8.
Z.Durumeric, M.Bailey and J.A.Halderman, An Internet-wide view of Internet-wide scanning, in: Proceedings of the 23rd USENIX Security Symposium, August 2014, 2014, pp. 65–78.
9.
E.Glatz and X.Dimitropoulos, Classifying Internet one-way traffic, in: Proceedings of the ACM Conference on Internet Measurement Conference, November 2012, 2012.
10.
W.Harrop and G.Armitage, Defining and evaluating greynets (sparse darknets), in: Proceedings of the 30th IEEE Conference on Local Computer Networks (LCN’05), November 2005, 2005.
11.
F.Iglesias and T.Zseby, Modelling IP darkspace traffic by means of clustering techniques, in: Proceedings of IEEE Conference on Communications and Network Security (CNS), October 2014, 2014, pp. 166–174.
12.
F.Iglesias and T.Zseby, Entropy-based characterization of Internet background radiation, Entropy17(1) (2015), 74–101.
13.
T.Karagiannis, K.Papagiannaki and M.Faloutsos, BLINC: Multilevel traffic classification in the dark, ACM SIGCOMM Computer Communication Review35(4) (2005), 229–240.
14.
C.Kreibich and J.Crowcroft, Honeycomb: Creating intrusion detection signatures using honeypots, ACM SIGCOMM Computer Communication Review34(1) (2004), 51–56.
15.
B.Li, J.Springer, G.Bebis and M.H.Gunes, A survey of network flow applications, Journal of Network and Computer Applications36(2) (2013), 567–581.
16.
L.Miao, W.Ding and H.Zhu, Extracting Internet background radiation from raw traffic using greynet, in: Proceedings of the 18th IEEE International Conference on Networks (ICON), IEEE, 2012, pp. 370–375.
17.
D.Moore, C.Shannon, D.J.Brown, G.M.Voelker and S.Savage, Inferring Internet denial of service activity, ACM Transactions on Computer Systems24(2) (2006), 115–139.
18.
D.Moore, C.Shannon, G.M.Voelker and S.Savage, Network telescopes, Technical report, Cooperative Association for Internet Data Analysis (CAIDA), July 2004.
19.
R.Pang, V.Yegneswaran, P.Barford, V.Paxson and L.Peterson, Characteristics of Internet background radiation, in: Proceedings of the 4th ACM SIGCOMM Conference on Internet Measurement, October 2004, 2004.
20.
S.Strapp and S.J.Yang, Segmenting large-scale cyber attacks for online behavior model generation, in: Proceedings of the 7th International Conference, SBP 2014, April 2014, 2014, pp. 169–177.
21.
A.M.Sukhov, D.I.Sidelnikov, A.P.Platonov and A.A.Galtsev, Active flows in diagnostic of troubleshooting on backbone links, Journal of High Speed Networks18(1) (2011), 69–81.
22.
R.Wang, L.Zhang and Z.Liu, A novel method for filtering Internet background radiation traffic, in: The 4th International Conference on Emerging Intelligent Data and Web Technologies (EIDWT), September 2013, IEEE, 2013, pp. 371–376.
23.
E.Wustrow, M.Karir, M.Bailey, F.Jahanian and G.Huston, Internet background radiation revisited, in: Proceedings of the 10th ACM SIGCOMM Conference on Internet Measurement, November 2010, 2010.
24.
K.Xu, Z.-L.Zhang and S.Bhattacharyya, Profiling Internet backbone traffic: Behavior models and applications, ACM SIGCOMM Computer Communication Review35(4) (2005), 169–180.
25.
K.Xu, Z.-L.Zhang and S.Bhattacharyya, Internet traffic behavior profiling for network security monitoring, IEEE/ACM Transactions on Networking16(6) (2008), 1241–1252.
26.
V.Yegneswaran, P.Barford and D.Plonka, On the design and use of Internet sinks for network abuse monitoring, in: Proceedings of the Symposium on Recent Advances in Intrusion Detection, September 2004, 2004, pp. 146–165.
27.
T.Zseby, N.Brownlee, A.King and K.Claffy, Nightlights: Entropy-based metrics for classifying darkspace traffic patterns, in: Proceedings of the 15th International Conference, PAM 2014, March 2014, 2014, pp. 275–277.
