Title:
Flow Based Observations from NETI@home and Honeynet Data
Flow Based Observations from NETI@home and Honeynet Data
Files
Author(s)
Grizzard, Julian B.
Simpson, Charles Robert, Jr.
Krasser, Sven
Owen, Henry L., III
Riley, George F.
Simpson, Charles Robert, Jr.
Krasser, Sven
Owen, Henry L., III
Riley, George F.
Advisor(s)
Editor(s)
Collections
Supplementary to
Permanent Link
Abstract
We conduct a flow based comparison of honeynet traffic,
representing malicious traffic, and NETI@home traffic, representing
typical end user traffic. We present a cumulative
distribution function of the number of packets for a TCP
flow and learn that a large portion of these flows in both
datasets are failed and potentially malicious connection attempts.
Next, we look at a histogram of TCP port activity
over large time scales to gain insight into port scanning and
worm activity. One key observation is that new worms can
linger on for more than a year after the initial release date.
Finally, we look at activity relative to the IP address space
and observe that the sources of malicious traffic are spread across the allocated range.
Sponsor
Date Issued
2005-06
Extent
1214423 bytes
Resource Type
Text
Resource Subtype
Proceedings