Sciweavers

Share
RAID
2004
Springer

On the Design and Use of Internet Sinks for Network Abuse Monitoring

9 years 9 months ago
On the Design and Use of Internet Sinks for Network Abuse Monitoring
Abstract. Monitoring unused or dark IP addresses offers opportunities to significantly improve and expand knowledge of abuse activity without many of the problems associated with typical network intrusion detection and firewall systems. In this paper, we address the problem of designing and deploying a system for monitoring large unused address spaces such as class A telescopes with 16M IP addresses. We describe the architecture and implementation of the Internet Sink (iSink) system which measures packet traffic on unused IP addresses in an efficient, extensible and scalable fashion. In contrast to traditional intrusion detection systems or firewalls, iSink includes an active component that generates response packets to incoming traffic. This gives the iSink an important advantage in discriminating between different types of attacks (through examination of the response payloads). The key feature of iSink’s design that distinguishes it from other unused address space monitors is...
Vinod Yegneswaran, Paul Barford, David Plonka
Added 02 Jul 2010
Updated 02 Jul 2010
Type Conference
Year 2004
Where RAID
Authors Vinod Yegneswaran, Paul Barford, David Plonka
Comments (0)
books