Internet Bad Neighborhoods Temporal Behavior

Internet Bad Neighborhoods Temporal Behavior

Moreira Moura, G.C.
Sadre, R.
Pras, A.

Technology, Policy and Management

POLG

2014-05-05

Malicious hosts tend to be concentrated in certain areas of the IP addressing space, forming the so-called Bad Neighborhoods. Knowledge about this concentration is valuable in predicting attacks from unseen IP addresses. This observation has been employed in previous works to filter out spam. In this paper, we focus on the temporal behavior of bad neighborhoods. The goal is to determine if bad neighborhoods strike multiple times over a certain period of time, and if so, when do the attacks occur. Among other findings, we show that even though bad neighborhoods do not exhibit a favorite combination of days to carry out attacks, 85% of the recurrent bad neighborhoods do carry out a second attack within the first 5 days from the first attack. These and the other findings here presented lead to several considerations on how attack prediction models can be more effective i.e., generating both predictive and short neighborhood blacklists.

http://resolver.tudelft.nl/uuid:c00b5dad-27a2-463a-972b-8f2fe433a847

IEEE

IEEE/IFIP NOMS 2014: Network Operations and Management Symposium "Management in a Software Defined World", Krakow, Poland, 5-9 May 2014; preprint

Institutional Repository

conference paper

(c) 2014 Moreira Moura, G.C.
Sadre, R.
Pras, A.