Sensing the Noise: Uncovering Communities in Darknet Traffic

Francesca Soro, Mauro Allegretta, Idilio Drago, Marco Mellia, Leandro Marcio Bertholdo

Research output: Chapter in Book/Report/Conference proceedingConference contributionAcademicpeer-review

Abstract

Darknets are ranges of IP addresses advertised without answering any traffic. Darknets help to uncover interesting network events, such as misconfigurations and network scans. Interpreting darknet traffic helps against cyber-attacks - e.g., malware often reaches darknets when scanning the Internet for vulnerable devices. The traffic reaching darknets is however voluminous and noisy, which calls for efficient ways to represent the data and highlight possibly important events. This paper evaluates a methodology to summarize packets reaching darknets. We represent the darknet activity as a graph, which captures remote hosts contacting the darknet nodes ports, as well as the frequency at which each port is reached. From these representations, we apply community detection algorithms in the search for patterns that could represent coordinated activity. By highlighting such activities we are able to group together, for example, groups of IP addresses that predominantly engage in contacting specific targets, or, vice versa, to identify targets which are frequently contacted together, for exploiting the vulnerabilities of a given service. The network analyst can recognize from the community detection results, for example, that a group of hosts has been infected by a botnet and it is currently scanning the network in search of vulnerable services (e.g., SSH and Telnet among the most commonly targeted). Such piece of information is impossible to obtain when analyzing the behavior of single sources, or packets one by one. All in all, our work is a first step towards a comprehensive aggregation methodology to automate the analysis of darknet traffic, a fundamental aspect for the recognition of coordinated and anomalous events.
Original languageEnglish
Title of host publication2020 Mediterranean Communication and Computer Networking Conference (MedComNet)
PublisherIEEE
ISBN (Electronic)978-1-7281-6248-5
ISBN (Print)978-1-7281-6249-2
DOIs
Publication statusPublished - 10 Sep 2020
Event18th Mediterranean Communication and Computer Networking Conference, MedComNet 2020 - Online Conference, Arona, Italy
Duration: 17 Jun 202019 Jun 2020
Conference number: 18
https://2020.medcomnet.org/

Conference

Conference18th Mediterranean Communication and Computer Networking Conference, MedComNet 2020
Abbreviated titleMedComNet2020
CountryItaly
CityArona
Period17/06/2019/06/20
Internet address

Fingerprint Dive into the research topics of 'Sensing the Noise: Uncovering Communities in Darknet Traffic'. Together they form a unique fingerprint.

Cite this