On the Design and Use of Internet Sinks for Network Abuse Monitoring

Abstract

Abstract.Monitoring unused or dark IP addresses offers opportunities to significantly improve and expand knowledge of abuse activity without many of the problems associated with typical network intrusion detection and firewall systems. In this paper, we address the problem of designing and deploying a system for monitoring large unused address spaces such as class A telescopes with 16M IP addresses. We describe the architecture and implementation of the Internet Sink (iSink) system which measures packet traffic on unused IP addresses in an efficient, extensible and scalable fashion. In contrast to traditional intrusion detection systems or firewalls, iSink includes an active component that generates response packets to incoming traffic. This gives the iSink an important advantage in discriminating between different types of attacks (through examination of the response payloads). The key feature of iSink's design that distinguishes it from other unused address space monitors is that its active response component is stateless and thus highly scalable. We report performance results of our iSink implementation in both controlled laboratory experiments and from a case study of a live deployment. Our results demonstrate the efficiency and scalability of our implementation as well as the important perspective on abuse activity that is afforded by its use.

Improving NIDS Performance Through Hardware-based Connection Filtering

“…We use IP-aliasing to emulate source and destination IP addresses from 32 different class C subnets (16 subnets for client IP addresses and 16 subnets for server IP addresses). We used the iSink system's active response capability to send response packets to malicious MACE traffic [19]. This enables bidirectional communication required to accurately recreate certain exploits.…”

An Invisible Localization Attack to Internet Threat Monitors

“…There have been many real-world developments and deployments of ITM systems. Examples include DOMINO (Distributed Overlay for Monitoring InterNet Outbreaks) [8], SANs ISC (Internet Storm Center) [6], Internet Sink [9], Network Telescope [10], CAIDA [11], MyNetWatchMan [12], and Honeynet [13], [14].…”

“…If the locations of monitors are identified, the attacker can deliberately avoid these monitors and directly attack the uncovered IP address space. It is a known fact that the number of sub-networks covered by monitors is much smaller than the total number of subnetworks in the Internet [6], [9], [10]. In other words, the IP address space covered by monitors represents a very small portion of the entire IP address space [6].…”

Contribution to the Design of a Flexible and Adaptive Solution for the Management of Heterogeneous Honeypot Systems

“…On one hand, the source-based filtering mechanisms are effective at reducing large repeated traffic rates into small number of manageable events. iSinks [24] uses a filtering strategy consisting of analyzing the connections established with the first N destination IPs per every source IP. In subsequent work [25], the authors have improved the filtering mechanisms taking into account, for example, the source payload, source port, source destination and source connection.…”

“…sensors, redirectors, etc. ), such as network telescopes [19], darknet [20], blackholes [21], IMS [27], and iSinks [24], or software artifice assigned with a portion of routed IP address space. Instead of deploying a large number of HIHs across multiple networks, they can be centrally deployed in a consolidated location.…”