No abstract

No abstract

In general, an IP packet passes through less than 30 routers before it reaches a destination host. According to our observations, some IP packets have an abnormal time-to-live (TTL) value that is decreased by more than 30 increments from the initial TTL. These packets are likely to be generated by special software. We assume that IP packets with strange TTL values are malicious. This study investigates this conjecture through several experiments, and the results show that malicious packets can be discriminated from legitimate ones by observing only TTL values.

Defender Cloud is a cloud based backbone network defending system having full scope over the whole backbone network. Rather than detecting suspicious network activities on a local area network, it collects and integrates the flow data from all connecting members and all entrances of a backbone network. After analyzing by a proposed cloud based distributed processing model, the corresponding defensive reaction can be carried out in a global basis. Thus its protection can cover the whole network, even including member institutions without their own firewall. This paper illustrates the design, verification and future perspective of the Defender Cloud, with an emphasis on the distributed processing of the flow data.

No abstract