On the Design and Use of Internet Sinks for Network Abuse Monitoring

摘要: Monitoring unused or dark IP addresses offers opportunities to significantly improve and expand knowledge of abuse activity without many the problems associated with typical network intrusion detection firewall systems. In this paper, we address problem designing deploying a system for monitoring large spaces such as class A telescopes 16M addresses. We describe architecture implementation Internet Sink (iSink) which measures packet traffic on in an efficient, extensible scalable fashion. contrast traditional systems firewalls, iSink includes active component that generates response packets incoming traffic. This gives important advantage discriminating between different types attacks (through examination payloads). The key feature iSink’s design distinguishes it from other space monitors is its stateless thus highly scalable. report performance results our both controlled laboratory experiments case study live deployment. Our demonstrate efficiency scalability well perspective afforded by use.