Inferring distributed reflection denial of service attacks from darknet

摘要: This work proposes a novel approach to infer and characterize Internet-scale DNS Distributed Reflection Denial of Service (DRDoS) attacks by leveraging the darknet space. Complementary pioneer on inferring (DDoS) activities using darknet, this shows that we can extract DDoS without relying backscattered analysis. The aim is cyber security intelligence related DRDoS such as intensity, rate geo-location in addition various network-layer flow-based insights. To achieve task, proposed exploits certain parameters detect expectation maximization k-means clustering techniques an attempt identify campaigns Attacks. We empirically evaluate 1.44TB real data collected from a/13 address space during recent several months period. Our analysis reveals was successful significant amplification including prominent attack targeted one largest anti-spam organizations. Moreover, disclosed mechanism attacks. Further, results uncover high-speed stealthy attempts were never previously documented. extracted insights validated case studies lead better understanding nature scale threat generate inferences could contribute detecting, preventing, assessing, mitigating even attributing activities.