A framework for the application of network telescope sensors in a global IP network

Irwin, Barry Vivian William

Title: A framework for the application of network telescope sensors in a global IP network
Creator: Irwin, Barry Vivian William
Subject: Sensor networks Computer networks TCP/IP (Computer network protocol) Internet Computer security Computers -- Access control Computer networks -- Security measures Computer viruses Malware (Computer software)
Date Issued: 2011
Date: 2011
Type: Thesis
Type: Doctoral
Type: PhD
Identifier: vital:4593
Identifier: http://hdl.handle.net/10962/d1004835
Description: The use of Network Telescope systems has become increasingly popular amongst security researchers in recent years. This study provides a framework for the utilisation of this data. The research is based on a primary dataset of 40 million events spanning 50 months collected using a small (/24) passive network telescope located in African IP space. This research presents a number of differing ways in which the data can be analysed ranging from low level protocol based analysis to higher level analysis at the geopolitical and network topology level. Anomalous traffic and illustrative anecdotes are explored in detail and highlighted. A discussion relating to bogon traffic observed is also presented. Two novel visualisation tools are presented, which were developed to aid in the analysis of large network telescope datasets. The first is a three-dimensional visualisation tool which allows for live, near-realtime analysis, and the second is a two-dimensional fractal based plotting scheme which allows for plots of the entire IPv4 address space to be produced, and manipulated. Using the techniques and tools developed for the analysis of this dataset, a detailed analysis of traffic recorded as destined for port 445/tcp is presented. This includes the evaluation of traffic surrounding the outbreak of the Conficker worm in November 2008. A number of metrics relating to the description and quantification of network telescope configuration and the resultant traffic captures are described, the use of which it is hoped will facilitate greater and easier collaboration among researchers utilising this network security technology. The research concludes with suggestions relating to other applications of the data and intelligence that can be extracted from network telescopes, and their use as part of an organisation’s integrated network security systems
Format: 327 leaves
Format: pdf
Publisher: Rhodes University
Publisher: Faculty of Science, Computer Science
Language: English
Rights: Irwin, Barry Vivian William

Hits: 2277
Visitors: 2537
Downloads: 568

Collections

RU Department of Information Systems

Irwin, Barry V W (Prof)

RU Department of Computer Science

		Thumbnail	File	Description	Size	Format
View Details Download			SOURCEPDF	PDF	4 MB	Adobe Acrobat PDF	View Details Download