Identifying Internet background radiation traffic based on traffic source distribution
Identifying Internet background radiation traffic based on traffic source distribution
复制标题
基于流量来源分布识别互联网背景辐射流量
DOI：
10.3233/jhs-150512
复制
发表时间：
2015
影响因子：
0.9
通讯作者：
Zhang, Ling
中科院分区：
文献类型：
--
作者：
Wang, Ruoyu;Liu, Zhen;Tao, Ming;Zhang, Ling
互联网背景辐射(IBR)流量识别对于恶意行为检测具有重要意义。针对传统的IBR流量识别方法依赖于全双向流量或未分配IP地址空间等苛刻条件的问题，提出了一种新的IBR流量识别方法。我们首先在一个流量数据集上研究了每个目的IP的流量来源分布，发现活跃IP的流量来源相对确定，而非活跃IP的流量来源相对不确定。其次，基于这些探索结果，我们提出了一种识别IBR流量的方法。它利用所提出的度量来评估目的IP的业务源的确定性，从而识别不活动的IP。然后根据恶意流量行为模式构建的启发式算法检测IBR流量。我们在实际流量数据集上进行了多次实验，结果表明，该方法在检测IPv4 IBR流量上获得了99%的准确率和0.1%的漏检率。检测到的IBR流量除了包含未分配的IP外，还包括发送到分配的IP的流量，这对于检测现实网络中的恶意流量更有价值和实用价值。
IBR (Internet Background Radiation) traffic identification is significant for malicious behavior detection. This paper presents a novel IBR traffic identification method since traditional methods depend on tough conditions, such as full bi-direction traffic or unassigned IP address space. We firstly explored the traffic source distribution of each destination IP on a traffic dataset, and found that the traffic sources of active IPs are relatively certain but that of inactive IPs are relatively uncertain. Secondly, based on this exploration results, we present a method to identify IBR traffic. It utilizes the presented metric to evaluate the certainty of traffic sources of a destination IP, so as to identify inactive IPs. Then it detects IBR traffic according to some heuristics built according to malicious traffic behavior patterns. We carried out several experiments to evaluate our method on real traffic datasets, and results show that it obtains 99% precision and 0.1% omission rate on detecting IPv4 IBR traffic. The detected IBR traffic includes the traffic that sent to assigned IPs besides unassigned IPs, which is more valuable and practical for detecting the malicious traffic in real networks.
登录
查看更多内容
DOI：
10.1145/1028788.1028794
发表时间：
2004-10
期刊：
--
影响因子：
--
作者：
Ruoming Pang;V. Yegneswaran;P. Barford;V. Paxson;L. Peterson
通讯作者：
Ruoming Pang;V. Yegneswaran;P. Barford;V. Paxson;L. Peterson
影响因子：
2.8
作者：
C. Kreibich;J. Crowcroft
通讯作者：
C. Kreibich;J. Crowcroft
DOI：
10.1109/tnet.2007.911438
发表时间：
2008-12
期刊：
IEEE/ACM Transactions on Networking
影响因子：
--
作者：
Kuai Xu;Zhi-Li Zhang;S. Bhattacharyya
通讯作者：
Kuai Xu;Zhi-Li Zhang;S. Bhattacharyya
DOI：
10.1109/eidwt.2013.70
发表时间：
2013-09
期刊：
2013 Fourth International Conference on Emerging Intelligent Data and Web Technologies
影响因子：
--
作者：
Ruoyu Wang;Ling Zhang;Z. Liu
通讯作者：
Ruoyu Wang;Ling Zhang;Z. Liu
影响因子：
1.5
作者：
Martin Drasar;Martin Vizváry;Jan Vykopal
通讯作者：
Martin Drasar;Martin Vizváry;Jan Vykopal