Computing Publications

Publications Home » Observing Internet Worm and Virus...

Observing Internet Worm and Virus Attacks with a Small Network Telescope

Uli Harder, Matthew Johnson, Jeremy T. Bradley, William J. Knottenbelt

National Workshop Paper
PASM 2005, Proceedings of the 2nd Workshop on Practical Applications of Stochastic Modelling
July, 2005
pp.113–126
Abstract

A network telescope is a portion of the IP address space which is devoted to observing inbound internet traffic. The purpose of a network telescope is to detect and log malicious traffic which originates from internet worms and viruses. In this paper, we investigate the statistical properties of observed traffic from a Class C telescope over a total of 3 months. We observe that only a few IP sources and destination ports are responsible for the majority of the traffic. We also demonstrate various ways to visualise the traffic profile from a telescope. We show that specific profiles can identify and distinguish portscans, hostscans and distributed denial-of-service (DDOS) attacks. Looking at the inter-arrival time of packets, the power spectrum and the detrended fluctuation analysis of the observed traffic, we show that there is very little sign of long range dependence. This is in stark contrast to other network traffic and presents exciting possibilities for identifying malicious traffic purely from its traffic profile.

Keywords
AESOP
PDF of full publication (1.3 megabytes)
(need help viewing PDF files?)
GZipped Postscript of full publication (240 kilobytes)
(need help viewing GZipped Postscript files?)
BibTEX file for the publication
N.B.
Conditions for downloading publications from this site.
 

pubs.doc.ic.ac.uk: built & maintained by Ashok Argent-Katwala.