The Internet Motion Sensor: A distributed global scoped Internet threat monitoring system

摘要: Networks are increasingly subjected to a broad spectrum of threats that impact the reliability and availability critical infrastructure. In response, researchers network operators have relied on monitoring characterize track these threats. This paper introduces Internet Motion Sensor (IMS), globally scoped threat system whose goal is measure, characterize, The dark address sensors in IMS extend simple passive capture using novel transport layer service emulation technique elicit payloads across all services, thereby addressing issue depth coverage. To achieve breadth coverage, employs distributed infrastructure utilizes aware their diversity position actively routed topology. Finally, uses an innovative signature encoding data warehousing combined with hierarchical architecture realize not only time space efficient, but also scalable global deployment. We explore various architectural tradeoffs context 3 year deployment multiple blocks ranging size from /24s /8. show how current emulates services diverse set topologies manner. Results three recent events presented illustrate utility such system: SCO Denial Service attacks (December, 2003), Blaster worm (August, Bagle backdoor scanning efforts (March, 2004).