错误的出站流量分析揭示静默的内部异常潜力
The Potential of Erroneous Outbound Traffic Analysis to Unveil Silent Internal Anomalies
AI总结：
本文通过分析错误出站流量，揭示内部网络中未被发现的安全威胁和网络问题，提供了一种新的被动测量视角。
摘要：
被动测量传统上专注于入站流量以检测恶意活动，基于威胁来自外部的假设。在本文中，我们提供了一种互补的视角，通过分析出站流量，认为一个狭窄的子集——我们称之为错误的出站流量——是一种更轻、揭示性更强但被忽视的数据源，用于识别广泛的安全威胁和网络问题。这种流量由内部主机发送的包组成，这些包要么没有响应，触发ICMP错误，或本身就是对未邀请请求的ICMP错误消息。为了展示其潜力，我们收集并分析了大型网络中的错误流量，揭示了多种之前未注意到的问题，包括配置错误、过时的部署和被入侵的主机。
英文摘要：
Passive measurement has traditionally focused on inbound traffic to detect malicious activity, based on the assumption that threats originate externally. In this paper, we offer a complementary perspective by examining outbound traffic, and argue that a narrow subset -- what we term erroneous outbound traffic -- is a lighter and revealing yet overlooked data source for identifying a broad range of security threats and network problems. This traffic consists of packets sent by internal hosts that either receive no response, trigger ICMP errors, or are ICMP error messages themselves generated in response to unsolicited requests. To demonstrate its potential, we collect and analyse erroneous traffic from a large network, uncovering a variety of previously unnoticed issues, including misconfigurations, obsolete deployments and compromised hosts.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
