II-EN: A Real-Time Lens into Dark Space of the Internet

University Of California-San Diego, La Jolla CA

Investigators

Abstract

Network telescopes, which observe unsolicited Internet traffic sent to unassigned address space, are one of the few types of instrumentation that allow global visibility into a wide range of security-related events. CAIDA researchers are expanding their telescope instrumentation to enable researchers to exploit this unique global data source and improve our understanding of security-related events such as large-scale attacks and malware spread. This innovative shift in network monitoring addresses sevearal pervasive challenges in network traffic research: collection and storage, efficient curation, and privacy-protected sharing of large volumes of data. CAIDA researchers are developing a taxonomy of observed traffic, including classes of DoS attacks, vulnerability scans, and malware spread. Such a taxonomy facilitates real-time detection of events that merit more comprehensive measurement and analysis and notification of interested researchers. This project will also enable infrastructure for vetted researchers to run analysis programs approximately one hour after data collection. CAIDA has developed a privacy-sensitive data sharing framework that integrates privacy-enhancing technology with proven and standard privacy principles and obligations of data seekers and data providers. The results of this project will contribute to developing early detection, reaction and mitigation strategies supporting the global fight against pervasive malware. Creation of educational data kits out of telescope data samples will link this research to educational outcomes. Most importantly, this project provides convenient remote access to a wealth of data, computing resources and Internet expertise aimed at supporting network security research.