Poster: Shedding light into the darknet: scanning characterization and detection of temporal changes
Poster: Shedding light into the darknet: scanning characterization and detection of temporal changes
复制标题
海报：将光线投射到暗网：扫描表征和时间变化检测
DOI：
10.1145/3485983.3493347
复制
发表时间：
2021
期刊：
影响因子：
--
通讯作者：
Kallitsis, Michalis
中科院分区：
文献类型：
--
作者：
Prajapati, Rupesh;Honavar, Vasant;Wu, Dinghao;Yen, John;Kallitsis, Michalis
网络望远镜提供了一个独特的窗口，可以了解与恶意软件传播、拒绝服务攻击、网络侦察等相关的互联网范围内的恶意活动。对该望远镜数据的分析可以突出显示互联网中正在发生的恶意事件，这些事件可用于实时预防或减轻网络威胁。然而，大型望远镜每天观测数百万个事件，这使得将这些知识转化为有意义的见解的任务充满挑战。为了解决这个问题，我们提出了一种新颖的框架来表征互联网的背景辐射并跟踪其时间演变。所提出的框架：（i）提取由从望远镜数据中提取的特征组成的望远镜扫描仪的高维表示，并学习这些事件的信息保存低维表示，该表示适合聚类；（ii）对结果表示空间进行聚类以表征扫描仪；（iii）利用聚类结果作为“签名”来检测网络望远镜中的时间变化。
Network telescopes provide a unique window into Internet-wide malicious activities associated with malware propagation, denial of service attacks, network reconnaissance, and others. Analyses of this telescope data can highlight ongoing malicious events in the Internet which can be used to prevent or mitigate cyber-threats in real-time. However, large telescopes observe millions of events on a daily basis which renders the task of transforming this knowledge to meaningful insights challenging. In order to address this, we present a novel framework for characterizing Internet’s background radiation and for tracking its temporal evolution. The proposed framework:(i) Extracts a high dimensional representation of telescope scanners composed of features distilled from telescope data and learns an information-preserving low-dimensional representation of these events that is amenable to clustering;(ii) Performs clustering of resulting representation space to characterize the scanners and (iii) Utilizes the clustering outcomes as “signatures" to detect temporal changes in the network telescope.