Characteristics of internet background radiation
Characteristics of internet background radiation
复制标题
DOI：
10.1145/1028788.1028794
复制
发表时间：
2004-10
期刊：
影响因子：
--
通讯作者：
Ruoming Pang;V. Yegneswaran;P. Barford;V. Paxson;L. Peterson
中科院分区：
文献类型：
--
作者：
Ruoming Pang;V. Yegneswaran;P. Barford;V. Paxson;L. Peterson
监控互联网地址空间的任何部分都能发现不间断的活动。即使在监控发送到未使用地址（我们称之为“背景辐射”）的流量时也是如此。背景辐射从根本上反映了非生产性的流量，要么是恶意的（大量反向散射、扫描漏洞、蠕虫），要么是良性的（配置错误）。虽然背景辐射的普遍存在已为网络运营商界所熟知，但其性质尚未得到广泛的描述。我们根据从互联网中四个未使用的网络收集的数据开发了这样一个特征。我们方法的两个关键要素是(i)使用滤波来减少测量系统的负荷，以及（ii）使用主动应答器来激发扫描仪的进一步活动，以区分不同类型的背景辐射。我们通过协议、应用和通常的具体利用来分解背景辐射的组成部分；分析时间模式和相关活动；并评估不同网络和时间的变化。虽然我们发现了各种各样的活动，但蠕虫和汽车的探针占据了主导地位。最后，我们考虑如何将我们的特征描述纳入监测和检测活动。
Monitoring any portion of the Internet address space reveals incessant activity. This holds even when monitoring traffic sent to unused addresses, which we term "background radiation. " Background radiation reflects fundamentally nonproductive traffic, either malicious (flooding backscatter, scans for vulnerabilities, worms) or benign (misconfigurations). While the general presence of background radiation is well known to the network operator community, its nature has yet to be broadly characterized. We develop such a characterization based on data collected from four unused networks in the Internet. Two key elements of our methodology are (i) the use of filtering to reduce load on the measurement system, and (ii) the use of active responders to elicit further activity from scanners in order to differentiate different types of background radiation. We break down the components of background radiation by protocol, application, and often specific exploit; analyze temporal patterns and correlated activity; and assess variations across different networks and over time. While we find a menagerie of activity, probes from worms and autorooters heavily dominate. We conclude with considerations of how to incorporate our characterizations into monitoring and detection activities.