Paper Info
Title
Identifying Internet Background Radiation Traffic Based On Traffic Source Distribution
Abstract
IBR (Internet Background Radiation) traffic identification is significant for malicious behavior detection. This paper presents a novel IBR traffic identification method since traditional methods depend on tough conditions, such as full bi-direction traffic or unassigned IP address space. We firstly explored the traffic source distribution of each destination IP on a traffic dataset, and found that the traffic sources of active IPs are relatively certain but that of inactive IPs are relatively uncertain. Secondly, based on this exploration results, we present a method to identify IBR traffic. It utilizes the presented metric to evaluate the certainty of traffic sources of a destination IP, so as to identify inactive IPs. Then it detects IBR traffic according to some heuristics built according to malicious traffic behavior patterns. We carried out several experiments to evaluate our method on real traffic datasets, and results show that it obtains 99% precision and 0.1% omission rate on detecting IPv4 IBR traffic. The detected IBR traffic includes the traffic that sent to assigned IPs besides unassigned IPs, which is more valuable and practical for detecting the malicious traffic in real networks.
Year
DOI
Venue
2015
10.3233/JHS-150512
JOURNAL OF HIGH SPEED NETWORKS
Keywords
Field
DocType
Internet background radiation traffic, malicious behavior, information entropy, network management
Traffic generation model,IPv4,Computer science,Internet traffic engineering,Floating car data,Computer network,Real-time computing,Heuristics,Background radiation,Traffic shaping,The Internet
Journal
Volume
Issue
ISSN
21
2
0926-6801
Citations 
PageRank 
References 
0
0.34
17
Authors
4
Name
Order
Citations
PageRank
Ruoyu Wang1317.63
Zhen Liu250.78
Ming Tao319224.65
Ling Zhang414314.77