Internet worm attacks pose a significant threat to network security and management. In this work, we coin the term Internet worm tomography as inferring the characteristics of Internet worms from the observations of Darknet or network telescopes that monitor a routable but unused IP address space. Under the framework of Internet worm tomography, we attempt to infer Internet worm temporal behaviors, i.e., the host infection time and the worm infection sequence, and thus pinpoint patient zero or initially infected hosts. Specifically, we introduce statistical estimation techniques and propose method of moments, maximum likelihood, and linear regression estimators. We show analytically and empirically that our proposed estimators can better infer worm temporal characteristics than a naive estimator that has been used in the previous work. We also demonstrate that our estimators can be applied to worms using different scanning strategies such as random scanning and localized scanning.
Merit Network, Inc.（梅里特网络公司）；Penn State University（宾夕法尼亚州立大学）
Network telescopes or "Darknets" provide a unique window into Internet-wide malicious activities associated with malware propagation, denial of service attacks, scanning performed for network reconnaissance, and others. Analyses of the resulting data can provide actionable insights to security analysts that can be used to prevent or mitigate cyber-threats. Large Darknets, however, observe millions of nefarious events on a daily basis which makes the transformation of the captured information into meaningful insights challenging. We present a novel framework for characterizing Darknet behavior …
In cybersecurity courses, it is quite challenging to do hands-on activities that involve many components of the Internet, such as bringing down the Internet, attacking a blockchain, etc. To solve this problem, we have developed an open-source Internet Emulator, which is a Python library, consisting of the classes for each essential element of the Internet, including autonomous system, network, host, router, BGP router, Internet exchange, etc. It also includes the classes for a variety of services, including Web server, DNS, Botnet, Darknet, Blockchain, and more are being developed. Using these…
International Hellenic University（国际希腊大学）；Democritus University of Thrace（德谟克利特大学）；Hellenic National Defence General Staff（希腊国防参谋本部）；University of Aegean（爱琴大学）
Attackers are perpetually modifying their tactics to avoid detection and frequently leverage legitimate credentials with trusted tools already deployed in a network environment, making it difficult for organizations to proactively identify critical security risks. Network traffic analysis products have emerged in response to attackers relentless innovation, offering organizations a realistic path forward for combatting creative attackers. Additionally, thanks to the widespread adoption of cloud computing, Device Operators processes, and the Internet of Things, maintaining effective network vis…
Characterizing AI-Assisted Bot Traffic in Darknet Data: Implications for ICS and IIoT Security
School of Engineering and Applied Sciences, Washington State University Tri-Cities（华盛顿州立大学三城市分校工程与应用科学学院）；Merit Network, Inc., University of Michigan（密歇根大学 Merit 网络公司）
Web is a primary and essential service to share information among users and organizations at present all over the world. Despite the current significance of such a kind of traffic on the Internet, the so-called Surface Web traffic has been estimated in just about 5% of the total. The rest of the volume of this type of traffic corresponds to the portion of Web known as Deep Web. These contents are not accessible by search engines because they are authentication protected contents or pages that are only reachable through the well known as darknets. To browse through darknets websites special aut…
