The dark oracle: perspective-aware unused and unreachable address discovery

摘要: Internet traffic destined for unused or unreachable addresses provides critically important information on malicious and misconfigured activity. Since address allocation policy is distributed across many devices, applications, administrative domains, constructing a comprehensive map of ("dark") challenging. In this paper, we present an architecture that automates the process discovering these dark by actively participating with allocation, routing, systems. Our approach to adopt local perspective revealing external private addresses, enabling detection threats coming into out network. To validate approach, construct prototype system called Dark Oracle uses internal routing data host configuration information, such as DHCP logs, automatically discover addresses. We experimentally evaluate using from large enterprise network, regional ISP, deployment academic