Collaborating against common enemies

摘要: This paper presents the first wide-scale study of correlated attacks, i.e., attacks mounted by same source IP against different networks. Using a large dataset from 1700 intrusion detection systems (IDSs), we show that are prevalent in current Internet; 20% all offending sources mount and they account for more than 40% IDS alerts our logs. We also reveal important characteristics these attacks. Correlated appear at networks within few minutes each other, indicating difficulty warding off occasional offline exchange lists malicious addresses. Furthermore, highly targeted. The IDSs can be divided into small groups with 4-6 members do not change time; group experience number while see almost no Our results have implications on collaborative common attackers. They collaborating need to alert information realtime. Further, exchanging among fixed correlation achieves benefits as IDSs, dramatically reducing overhead.