Investigating the dark cyberspace: Profiling, threat-based analysis and correlation

摘要: An effective approach to gather cyber threat intelligence is collect and analyze traffic destined unused Internet addresses known as darknets. In this paper, we elaborate on such capability by profiling darknet data. Such information could generate indicators of activity well providing in-depth understanding the nature its traffic. Particularly, packets distribution, used transport, network application layer protocols pinpoint resolved domain names. Furthermore, identify IP classes destination ports geo-locate source countries. We further investigate darknet-triggered threats. The aim explore embedded threats categorize their severities. Finally, contribute exploring inter-correlation threats, applying association rule mining techniques, build rules. Specifically, clusters that co-occur targeting a specific victim. work proves are correlated. Moreover, it provides insights about patterns allows interpretation scenarios.