Vulnerabilities of passive internet threat monitors

摘要: Passive Internet monitoring is a powerful tool for measuring and characterizing interesting network activity like worms or distributed denial of service attacks. By employing statistical analysis on the captured traffic, threat monitors gain valuable insight into nature threats. In past, these have been successfully used not only to detect DoS attacks worm outbreaks but also monitor propagation trends other malicious activities Internet. Today, passive are widely recognized as an important technology detecting understanding anomalies in macroscopic way. Unfortunately, that publish their results provide feedback loop can be by adversaries deduce monitor's sensor locations. Knowledge location severely reduce its functionality data may tampered with no longer trusted. This paper describes algorithms which address spaces listens presents empirical evidences they successful locating positions deployed We present solutions make "harder detect".