Detecting Internet-Scale Surveillance Devices Using RTSP Recessive Features

Yan, Zhaoteng; Li, Zhi; Bai, Wenping; Ye, Nan; Zhu, Hongsong; Sun, Limin

doi:10.1007/978-3-030-89137-4_2

Cited by 3 publications

(1 citation statement)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The need for better Internet measurement has grown with the importance of the Internet and the corresponding increase in cyber threats. Recent Internet measurements shed light on a range of important questions, such as the connectivity of public clouds [14], Geolocating Internet routers [15], identifying state-owned Internet operators [16], the statistical shape of video viewership [17], mapping the domains of e-mail service providers [18], detecting Internet-scale surveillance devices [19], and botnet detection [20]. Vantage point plays a key role in these measurements hightlighting the need for correlating measure-ments.…”

mentioning

confidence: 99%

Temporal Correlation of Internet Observatories and Outposts

Kepner,

Jones,

Andersen

et al. 2022

Preprint

View full text Add to dashboard Cite

The Internet has become a critical component of modern civilization requiring scientific exploration akin to endeavors to understand the land, sea, air, and space environments. Understanding the baseline statistical distributions of traffic are essential to the scientific understanding of the Internet. Correlating data from different Internet observatories and outposts can be a useful tool for gaining insights into these distributions. This work compares observed sources from the largest Internet telescope (the CAIDA darknet telescope) with those from a commercial outpost (the GreyNoise honeyfarm). Neither of these locations actively emit Internet traffic and provide distinct observations of unsolicited Internet traffic (primarily botnets and scanners). Newly developed GraphBLAS hyperspace matrices and D4M associative array technologies enable the efficient analysis of these data on significant scales. The CAIDA sources are well approximated by a Zipf-Mandelbrot distribution. Over a 6-month period 70% of the brightest (highest frequency) sources in the CAIDA telescope are consistently detected by coeval observations in the GreyNoise honeyfarm. This overlap drops as the sources dim (reduce frequency) and as the time difference between the observations grows. The probability of seeing a CAIDA source is proportional to the logarithm of the brightness. The temporal correlations are well described by a modified Cauchy distribution. These observations are consistent with a correlated high frequency beam of sources that drifts on a time scale of a month.

show abstract

mentioning

confidence: 99%