Darknet Traffic Analysis by Focusing on The Stability of Traffic

บทคัดย่อ

Darknet is reachable but unused IP address space. Since legitimate hosts will generally have no reason to send packets to darknet, most of the packets seen in darknet are results of attacks, experiments or errors. Thus, darknet traffic analysis is a good candidate to understand the activities of attackers, worms, and infected hosts in the Internet. In this paper, we analyse darknet traffic by focusing on traffic stability. The concept of traffic stability is that the relative volume of dominant traffic components do not change drastically. We hypothesize that though the volume of darknet traffic is orders of magnitude smaller than Internet traffic, the stability principle holds and that the instabilities in traffic indicate the occurrence of some events in darknet. We categorize packets in darknet based on values of the fields in the packet header and calculate the volume of dominant components. We analysed two datasets of darknet traffic and found several significant instabilities. We analysed the causes of the instabilities and characteristics of the corresponding packet categories. Some of the detected events could be correlated with known and recorded network events. The analysis results show that traffic stability is a useful concept even for darknet traffic analysis.