Darknet Traffic Analysis and Classification Using Numerical AGM and Mean Shift Clustering Algorithm

摘要: The cyberspace continues to evolve more complex than ever anticipated, and same is the case with security dynamics there. As our dependence on increasing day-by-day, regular systematic monitoring of has become very essential. A darknet one such framework for deducing malicious activities attack patterns in cyberspace. Darknet traffic spurious observed empty address space, i.e., a set globally valid Internet Protocol (IP) addresses which are not assigned any hosts or devices. In an ideal secure network system, no expected arrive IP space. However, reality, noticeable amount this space primarily due wide activities, attacks sometimes level misconfigurations. Analyzing finding distinct present them can be potential mechanism infer trends real network. paper, existing Basic Extended AGgregate Mode (AGM) data formats analysis studied efficient 29-tuple Numerical AGM format suitable analyzing source validated TCP connections (three-way handshake) proposed find using Mean Shift clustering algorithm. detected from clusters results providing traces various as Mirai bot, SQL attack, brute force. TCP, technique Cyber