Leveraging Internet Background Radiation for Opportunistic Network Analysis

Benson, Karyn; Dainotti, Alberto; claffy, kc; Snoeren, Alex C.; Kallitsis, Michael

doi:10.1145/2815675.2815702

Cited by 23 publications

(25 citation statements)

References 43 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A fifth of the remaining 14% that do not generate IBR traffic are blocks that belong to the US government. The temporal analysis in [4] also shows that most networks frequently generate IBR traffic, in particular when considering coarse grain aggregations. Indeed, the median time between observations is shorter than 1 minute for over 90% of countries, and is shorter than 10 minutes for about 75% of the ASs.…”

Section: Datasetmentioning

confidence: 95%

“…Indeed, the amount of IBR packets that reaches network telescopes is considerable, incessant, and originates from a variety of applications [31]. In [4], Benson et al performed a spatial analysis and determined that IBR provided an Internet-wide view. All countries, except for 3 with a population of less than 4000 inhabitants, and more than half of all ASs are observed in their dataset.…”

Section: Datasetmentioning

confidence: 99%

See 1 more Smart Citation

Chocolatine: Outage Detection for Internet Background Radiation

Guillot

Fontugne

Winter

et al. 2019

2019 Network Traffic Measurement and Analysis Conference (TMA)

Self Cite

View full text Add to dashboard Cite

The Internet is a complex ecosystem composed of thousands of Autonomous Systems (ASs) operated by independent organizations; each AS having a very limited view outside its own network. These complexities and limitations impede network operators to finely pinpoint the causes of service degradation or disruption when the problem lies outside of their network. In this paper, we present Chocolatine, a solution to detect remote connectivity loss using Internet Background Radiation (IBR) through a simple and efficient method. IBR is unidirectional unsolicited Internet traffic, which is easily observed by monitoring unused address space. IBR features two remarkable properties: it is originated worldwide, across diverse ASs, and it is incessant. We show that the number of IP addresses observed from an AS or a geographical area follows a periodic pattern. Then, using Seasonal ARIMA to statistically model IBR data, we predict the number of IPs for the next time window. Significant deviations from these predictions indicate an outage. We evaluated Chocolatine using data from the UCSD Network Telescope, operated by CAIDA, with a set of documented outages. Our experiments show that the proposed methodology achieves a good trade-off between true-positive rate (90%) and falsepositive rate (2%) and largely outperforms CAIDA's own IBRbased detection method. Furthermore, performing a comparison against other methods, i.e., with BGP monitoring and active probing, we observe that Chocolatine shares a large common set of outages with them in addition to many specific outages that would otherwise go undetected.

show abstract

Section: Datasetmentioning

confidence: 95%

Section: Datasetmentioning

confidence: 99%

Chocolatine: Outage Detection for Internet Background Radiation

Guillot

Fontugne

Winter

et al. 2019

2019 Network Traffic Measurement and Analysis Conference (TMA)

Self Cite

View full text Add to dashboard Cite

show abstract

“…Dainotti et al detect Internet outages at the country level by identifying times of reduced traffic from addresses in certain countries toward unused IPv4 address space [22]. Traffic to unused portions of the IPv4 address space is often sent by misconfigured devices or malicious hosts [12] who may spoof their source addresses, making it difficult to infer if addresses sending traffic to the darknet are actively in use by user devices.…”

Section: Related Workmentioning

confidence: 99%

Advancing the Art of Internet Edge Outage Detection

Richter

Padmanabhan

Spring

et al. 2018

Proceedings of the Internet Measurement Conference 2018

View full text Add to dashboard Cite

Measuring reliability of edge networks in the Internet is difficult due to the size and heterogeneity of networks, the rarity of outages, and the difficulty of finding vantage points that can accurately capture such events at scale. In this paper, we use logs from a major CDN, detailing hourly request counts from address blocks. We discovered that in many edge address blocks, devices, collectively, contact the CDN every hour over weeks and months. We establish that a sudden temporary absence of these requests indicates a loss of Internet connectivity of those address blocks, events we call disruptions.We develop a disruption detection technique and present broad and detailed statistics on 1.5M disruption events over the course of a year. Our approach reveals that disruptions do not necessarily reflect actual service outages, but can be the result of prefix migrations. Major natural disasters are clearly represented in our data as expected; however, a large share of detected disruptions correlate well with planned human intervention during scheduled maintenance intervals, and are thus unlikely to be caused by external factors. Cross-evaluating our results we find that current state-of-the-art active outage detection over-estimates the occurrence of disruptions in some address blocks. Our observations of disruptions, service outages, and different causes for such events yield implications for the design of outage detection systems, as well as for policymakers seeking to establish reporting requirements for Internet services.

show abstract

“…While the existence of widespread port scanning activity is widely known [7,8,10,18], comparably little research has been devoted to study and understand scanners and their strategies in detail. The lack of high quality data stems mostly from the absence of data sources that can illuminate scanning activity at scale.…”

Section: Introductionmentioning

confidence: 99%

“…Secondly, since darknets do not emit any traffic, their only attraction of traffic is their routed address space. Thus, darknets will only be able to detect scanning activity that targets either the entire IPv4 space, a sufficiently large random subset, or the unlikely case of scans targeting the darknet itself [10,18]. They cannot provide insights into scans targeting specific regions of the address space, e.g., prefixes or networks with known clients, servers or other types of "live" hosts.…”

Section: Introductionmentioning

confidence: 99%

Scanning the Scanners

Richter

Berger

2019

Proceedings of the Internet Measurement Conference

View full text Add to dashboard Cite

Scanning of hosts on the Internet to identify vulnerable devices and services is a key component in many of today's cyberattacks. Tracking this scanning activity, in turn, provides an excellent signal to assess the current state-of-affairs for many vulnerabilities and their exploitation. So far, studies tracking scanning activity have relied on unsolicited traffic captured in darknets, focusing on random scans of the address space. In this work, we track scanning activity through the lens of unsolicited traffic captured at the firewalls of some 89,000 hosts of a major Content Distribution Network (CDN). Our vantage point has two distinguishing features compared to darknets: (i) it is distributed across some 1,300 networks, and (ii) its servers are live, offering services and thus emitting traffic. While all servers receive a baseline level of probing from Internet-wide scans, i.e., scans targeting random subsets of or the entire IPv4 space, we show that some 30% of all logged scan traffic is the result of localized scans. We find that localized scanning campaigns often target narrow regions in the address space, and that their characteristics in terms of target selection strategy and scanned services differ vastly from the more widely known Internet-wide scans. Our observations imply that conventional darknets can only partially illuminate scanning activity, and may severely underestimate widespread attempts to scan and exploit individual services in specific prefixes or networks. Our methods can be adapted for individual network operators to assess if they are subjected to targeted scanning activity.

show abstract

Leveraging Internet Background Radiation for Opportunistic Network Analysis

Cited by 23 publications

References 43 publications

Chocolatine: Outage Detection for Internet Background Radiation

Chocolatine: Outage Detection for Internet Background Radiation

Advancing the Art of Internet Edge Outage Detection

Scanning the Scanners

Contact Info

Product

Resources

About