Sciweavers

Share
CONEXT
2007
ACM

Identifying dynamic IP address blocks serendipitously through background scanning traffic

9 years 5 months ago
Identifying dynamic IP address blocks serendipitously through background scanning traffic
Today's Internet contains a large portion of "dynamic" IP addresses, which are assigned to clients upon request. A significant amount of malicious activities have been reported from dynamic IP space, such as spamming, botnets, etc.. Accurate identification of dynamic IP addresses will help build blacklists of suspicious hosts with more confidence, and help track the sources of different types of anomalous activities. In this paper, we contrast traffic activity patterns between static and dynamic IP addresses in a large campus network, as well as their activity patterns when countering outside scanning traffic. Based on the distinct characteristics observed, we propose a scanning-based technique for identifying dynamic IP addresses in blocks. We conduct an experiment using a month-long data collected from our campus network, and instead of scanning our own network, we utilize identified outside scanning traffic. The experiment results demonstrate a high classification ra...
Yu Jin, Esam Sharafuddin, Zhi-Li Zhang
Added 14 Aug 2010
Updated 14 Aug 2010
Type Conference
Year 2007
Where CONEXT
Authors Yu Jin, Esam Sharafuddin, Zhi-Li Zhang
Comments (0)
books