Internet Bad Neighborhoods Temporal Behavior

Conference paper (2014)
Department
POLG (TPM) (TU Delft)
Copyright: Pras, A.
More Info
expand_more

Published Date

05-05-2014

Reuse Rights

Other than for strictly personal use, it is not permitted to download, forward or distribute the text or part of it, without the consent of the author(s) and/or copyright holder(s), unless the work is under an open content license such as Creative Commons.

Source:

IEEE/IFIP NOMS 2014: Network Operations and Management Symposium "Management in a Software Defined World", Krakow, Poland, 5-9 May 2014; preprint

Faculty

Technology, Policy and Management

Department

POLG

Abstract

Malicious hosts tend to be concentrated in certain areas of the IP addressing space, forming the so-called Bad Neighborhoods. Knowledge about this concentration is valuable in predicting attacks from unseen IP addresses. This observation has been employed in previous works to filter out spam. In this paper, we focus on the temporal behavior of bad neighborhoods. The goal is to determine if bad neighborhoods strike multiple times over a certain period of time, and if so, when do the attacks occur. Among other findings, we show that even though bad neighborhoods do not exhibit a favorite combination of days to carry out attacks, 85% of the recurrent bad neighborhoods do carry out a second attack within the first 5 days from the first attack. These and the other findings here presented lead to several considerations on how attack prediction models can be more effective i.e., generating both predictive and short neighborhood blacklists.

Files

Noms2014.pdf
(pdf | 0.332 Mb)