Sensing the Noise: Uncovering Communities in Darknet Traffic

摘要: Darknets are ranges of IP addresses advertised without answering any traffic. help to uncover interesting network events, such as misconfigurations and scans. Interpreting darknet traffic helps against cyber-attacks – e.g., malware often reaches darknets when scanning the Internet for vulnerable devices. The reaching is however voluminous noisy, which calls efficient ways represent data highlight possibly important events. This paper evaluates a methodology summarize packets darknets. We activity graph, captures remote hosts contacting nodes ports, well frequency at each port reached. From these representations, we apply community detection algorithms in search patterns that could coordinated activity. By highlighting activities able group together, example, groups predominantly engage specific targets, or, vice versa, identify targets frequently contacted exploiting vulnerabilities given service. analyst can recognize from results, has been infected by botnet it currently services (e.g., SSH Telnet among most commonly targeted). Such piece information impossible obtain analyzing behavior single sources, or one one. All all, our work first step towards comprehensive aggregation automate analysis traffic, fundamental aspect recognition anomalous