Identifying and tracking suspicious activities through IP gray space analysis

Yu Jin, Zhi Li Zhang, Kuai Xu, Feng Cao, Sambit Sahu

Research output: Chapter in Book/Report/Conference proceedingConference contribution

15 Scopus citations

Abstract

Campus or enterprise networks often have many unassigned IP addresses that collectively form IP gray space within the address blocks of such networks. Using one-month traffic data collected in a large campus network, we have monitored a significant amount of unwanted traffic towards IP gray space in various forms, such as worms, port scanning, and denial of service attacks. In this paper, we apply a heuristic algorithm to extract the IP gray space in our campus network. Subsequently, we analyze the behavioral patterns such as dominant activities and target randomness, of the gray space traffic for individual outside hosts. By correlating and contrasting the traffic towards IP gray addresses and live end hosts, we find the gray space traffic provides unique insight for uncovering the behavior, and intention,of anomalous traffic towards live end hosts. Finally, we demonstrate the applications of gray space traffic for identifying SPAM behavior, detecting malicious scanning and worm activities that successfully compromise end hosts.

Original languageEnglish (US)
Title of host publicationMineNet'07
Subtitle of host publicationProceedings of the Third Annual ACM Workshop on Mining Network Data
Pages7-12
Number of pages6
DOIs
StatePublished - Aug 31 2007
Externally publishedYes
EventMineNet'07: 3rd Annual ACM Workshop on Mining Network Data - San Diego, CA, United States
Duration: Jun 12 2007Jun 12 2007

Publication series

NameMineNet'07: Proceedings of the Third Annual ACM Workshop on Mining Network Data

Other

OtherMineNet'07: 3rd Annual ACM Workshop on Mining Network Data
CountryUnited States
CitySan Diego, CA
Period6/12/076/12/07

Keywords

  • Anomaly detection
  • Entropy
  • IP gray space
  • Network trafc analysis
  • Profling

ASJC Scopus subject areas

  • Computer Science Applications
  • Information Systems
  • Theoretical Computer Science

Fingerprint Dive into the research topics of 'Identifying and tracking suspicious activities through IP gray space analysis'. Together they form a unique fingerprint.

  • Cite this

    Jin, Y., Zhang, Z. L., Xu, K., Cao, F., & Sahu, S. (2007). Identifying and tracking suspicious activities through IP gray space analysis. In MineNet'07: Proceedings of the Third Annual ACM Workshop on Mining Network Data (pp. 7-12). (MineNet'07: Proceedings of the Third Annual ACM Workshop on Mining Network Data). https://doi.org/10.1145/1269880.1269883