Identifying and modeling unwanted traffic on the Internet

Accurate models of Internet traffic are important for successful testing of devices that provide network security. However, with the growth of the Internet. it has become increasingly difficult to develop and maintain accurate traffic models. While much internet traffic is legitimate, productive communications between users and services, a significant portion of Internet traffic is the result of unwanted messages sent to IP addresses without regard as to whether there is an active host at that address. In an effort to analyze unwanted traffic, tools were developed that generate statistics and plots on captured unwanted traffic to unused IP addresses. These tools were used on a four-day period of traffic received on an inactive IPv4 class A network address space. Each class B subnet in this address space received an average of 7 million packets corresponding to 21 packets per second. Analyses were performed on a range of class B and C subnets with the intent of discovering the types of variability that are characteristic of unwanted traffic. Traffic volume over time, number of scans, destinations ports, and traffic sources varied substantially across class B and C subnets.

Department dc:contributor.department

Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science

Grantor dc:publisher

Massachusetts Institute of Technology

Year dc:date.issued

2006

Author dc:creator

• Soto, Paul, M. Eng. Massachusetts Institute of Technology

Advisor dc:contributor.advisor

• Richard Lippmann.

• Electrical Engineering and Computer Science.

Statement dc:rights

• M.I.T. theses are protected by copyright. They may be viewed from this source for any purpose, but reproduction or distribution in any format is prohibited without written permission. See provided URL for inquiries about permission.

Licence dc:rights.uri

• http://dspace.mit.edu/handle/1721.1/7582

Language dc:language.iso

eng

Handle dc:identifier.uri

http://hdl.handle.net/1721.1/37100

OAI identifier oai:identifier

oai:dspace.mit.edu:1721.1/37100