Sensing the noise: unveiling communities in darknet traffic - Francesca Soro
Presenter: Francesca Soro
Darknets are ranges of IP addresses advertised without answering any traffic. Darknets help to uncover interesting network events, such as misconfigurations and network scans. Interpreting darknet traffic helps against cyber-attacks — e.g., malware often reaches darknets when scanning the Internet for vulnerable devices. The traffic reaching darknets is however voluminous and noisy, which calls for efficient ways to represent the data and highlight possibly important events.
This paper evaluates a methodology to summarize packets reaching darknets. The darknet activity is represented as a graph, which captures remote hosts contacting the darknet nodes ports, as well as the frequency at which each port is reached. From these representations, community detection algorithms are applied in the search for patterns that could represent coordinated activity. By highlighting such activities it is possible to group together, for example, groups of IP addresses that predominantly engage in contacting specific targets, or, vice versa, to identify targets which are frequently contacted together, for exploiting the vulnerabilities of a given service. The network analyst can recognize from the community detection results, for example, that a group of hosts has been infected by a botnet and it is currently scanning the network in search of vulnerable services (e.g., SSH and Telnet among the most commonly targeted). Such piece of information is impossible to obtain when analyzing the behavior of single sources, or packets one by one.
All in all, SmartData@PoliTO's work is a first step towards a comprehensive aggregation methodology to automate the analysis of darknet traffic, a fundamental aspect for the recognition of coordinated and anomalous events.
SmartTalks are webinars in which the PhD students of the SmartData@PoliTO center present their research work.
They will be held on Mondays at 4:30 PM CEST every two weeks.