Internet bad neighborhoods

Abstract

Thanks to technology, what almost anybody can do has been multiplied a thousandfold, and our moral understanding about what we ought to do hasn't kept pace. ... You can lay minefields, smuggle nuclear weapons in suitcases, make nerve gas, and drop "smart bombs" with pinpoint accuracy. Also, you can arrange to have a hundred dollars a month automatically sent from your bank account to provide education for ten girls in an Islamic country who otherwise would not learn to read and write .... You can use the Internet to organize citizen monitoring of environmental hazards, or to check the honesty and performance of government officials-or to spy on your neighbors. Now, what ought we to do?-DANIEL DENNETT, 2006 IN: BREAKING THE SPELL. vi Gratus animus est una virtus non solum maxima, sed etiam mater virtutum omnium reliquarum.

Internet Bad Neighborhoods temporal behavior

“…We showed in Section II-B that daily number of BadHoods attacking a target varies with the data source and misused application (also investigated in Chapter 7 in [8]); therefore an attack prediction model should leverage this and one could not expect an "one-sizefits-all" temporal prediction model. Also, the usefulness of the recent historical past has been proved first research question since up to 95% of BadHoods are likely to attack more than one day, which justifies its use to predict future attacks.…”

“…Bad Neighborhoods can be seen as subnetworks having higher concentrations of malicious IP addresses than the measured average [1], [5]- [8]. For example, we found in a previous study that 50% of spamming IP addresses on the Internet can be traced back to only 20 Autonomous Systems (ASes) [8].…”

“…For this filter, we have generated BadHood blacklists using a single day. These findings then led to a Ph.D. dissertation [8].…”

“…CBL and Dshield datasets, as discussed in [7] and in Chapter 7 in [8], can be seen as public blacklists, which are usually generated using a large number of honeypots/traps distributed over many networks, which increases the probability of blacklisting more sources. UT/EWI data set, on the other hand, was generated based on the incoming traffic to two mail server.…”

“…The issue of the bad neighborhood size was investigated in [6], while the performance of third-party spam blacklists was evaluated in [7]. Ultimately led to the Ph.D. dissertation of one of the authors [8], [14].…”