Toward understanding distributed blackhole placement

ABSTRACT

The monitoring of unused Internet address space has been shown to be an effective method for characterizing Internet threats including Internet worms and DDOS attacks. Because there are no legitimate hosts in an unused address block, traffic must be the result of misconfiguration, backscatter from spoofed source addresses, or scanning from worms and other probing. This paper extends previous work characterizing traffic seen at specific unused address blocks by examining differences observed between these blocks. While past research has attempted to extrapolate the results from a small number of blocks to represent global Internet traffic, we present evidence that distributed address blocks observe dramatically different traffic patterns. This work uses a network of blackhole sensors which are part of the Internet Motion Sensor (IMS) collection infrastructure. These sensors are deployed in networks belonging to service providers, large enterprises, and academic institutions representing a diverse sample of the IPv4 address space. We demonstrate differences in traffic observed along three dimensions: over all protocols and services, over a specific protocol and service, and over a particular worm signature. This evidence is then combined with additional experimentation to build a list of sensor properties providing plausible explanations for these differences. Using these properties, we conclude with recommendations for the understanding the implications of sensor placement.

REFERENCES

• 1: CERT. CERT Advisory CA-2001-26 Nimda Worm. http://www.cert.org/advisories/CA-2001-26.html, September 2001.
• 2: CERT. Code Red II: Another worm exploiting buffer overflow in IIS indexing service DLL. http://www.cert.org/incident_notes/IN-2001-09.html, August 2001.
• 3: CERT. CERT Advisory CA-2003-20 W32/Blaster worm. http://www.cert.org/advisories/CA-2003-20.html, August 2003.
• 4: CERT. CERT advisory CA-2003-20 W32/Blaster worm. http://www.cert.org/advisories/CA-2003-20.html, August 2003.
• 5: Cisco Systems. Net Flow services and applications, 1999.
• 6: Evan Cooke, Michael Bailey, David Watson, Farnam Jahanian, and Jose Nazario. The Internet motion sensor: A distributed global scoped Internet threat monitoring system. Technical Report CSE-TR-491-04, University of Michigan, Electrical Engineering and Computer Science, July 2004.
• 7: Dan Golding. Peering Evolution. Nanog Presentation, October 2002.
• 8: Craig Labovitz, Abha Ahuja, and Michael Bailey. Shining Light on Dark Address Space. http://www.arbornetworks.com/downloads/research38/dark_address_space.pdf, November 2001.
• 9: Zhuoqing Morley Mao , Ramesh Govindan , George Varghese , Randy H. Katz, Route flap damping exacerbates internet routing convergence, Proceedings of the 2002 conference on Applications, technologies, architectures, and protocols for computer communications, August 19-23, 2002, Pittsburgh, Pennsylvania, USA
• 10: Microsoft Corporation. What you should know about the Sasser worm and its variants. http://www.microsoft.com/security/incident/sasser.mspx, May 2004.
• 11: David Moore. Network telescopes: Observing small or distant security events. In 11th USENIX Security Symposium, Invited talk, San Francisco, CA, August 5--9 2002. Unpublished.
• 12: David Moore , Vern Paxson , Stefan Savage , Colleen Shannon , Stuart Staniford , Nicholas Weaver, Inside the Slammer Worm, IEEE Security and Privacy, v.1 n.4, p.33-39, July 2003 [doi>10.1109/MSECP.2003.1219056]
• 13: David Moore, Colleen Shannon, Geoffrey M. Voelker, and Stefan Savage. Network Telescopes: Technical Report. Technical report, Cooperative Association for Internet Data Analysis - CAIDA, 2004.
• 14: David Moore, Geoffrey M. Voelker, and Stefan Savage. Inferring Internet denial-of-service activity. In Proceedings of the Tenth USENIX Security Symposium, pages 9--22, Washington, D.C., August 13--17 2001. USENIX.
• 15: Chris Morrow and Brian Gemberling. How to Allow your Customers to blackhole their own traffic. http://www.secsup.org/CustomerBlackHole/.
• 16: R. Pang, V. Yegneswaran, P. Barford, V. Paxson, and L. Peterson. Characteristics of Internet Background Radiation. Available at http://www.cs.princeton.edu/nsg/papers/telescope.pdf.
• 17: Vern Paxson, Bro: a system for detecting network intruders in real-time, Computer Networks: The International Journal of Computer and Telecommunications Networking, v.31 n.23-24, p.2435-2463, Dec. 1999 [doi>10.1016/S1389-1286(99)00112-7]
• 18: Niels Provos. Honeyd ---A virtual honeypot daemon. In 10th DFN-CERT Workshop, Hamburg, Germany, February 2003.
• 19: Martin Roesch, Snort - Lightweight Intrusion Detection for Networks, Proceedings of the 13th USENIX conference on System administration, November 07-12, 1999, Seattle, Washington
• 20: SANS Institute. Internet storm center. http://isc.incidents.org/, June 2004.
• 21: Colleen Shannon and David Moore. The spread of the Witty worm. http://www.caida.org/analysis/secuirty/witty/, June 2004.
• 22: Dug Song, Rob Malan, and Robert Stone. A snapshot of global Internet worm activity. Technical report, Arbor Networks, 2001.
• 23: L. Spitzner, Honeypots: Tracking Hackers, Addison-Wesley Longman Publishing Co., Inc., Boston, MA, 2002
• 24: Lance Spitzner et al. The honeynet project. http://project.honeynet.org/, June 2004.
• 25: Robert Stone. CenterTrack: An IP overlay network for tracking DoS floods. In USENIX, editor, Proceedings of the 9th USENIX Security Symposium, pages 199--212, Berkeley, CA, USA, August 14--17 2000. The USENIX Association.
• 26: Symantec Corp. Linux.Slapper.Worm. http://securityresponse.symantec.com/avcenter/venc/data/linux.slapper.worm.html.
• 27: Team CYMRU. The darknet project. http://www.cymru.com/Darknet/index.html, June 2004.
• 28: University of Oregon.RouteViews project. http://www.routeviews.org/.
• 29: Nicholas Weaver , Vern Paxson , Stuart Staniford , Robert Cunningham, A taxonomy of computer worms, Proceedings of the 2003 ACM workshop on Rapid malcode, October 27-27, 2003, Washington, DC, USA [doi>10.1145/948187.948190]
• 30: Vinod Yegneswaran, Paul Barford, and Somesh Jha. Global intrusion detection in the DOMINO overlay system. In Proceedings of Network and Distributed System Security Symposium ( NDSS '04), San Diego, CA, February 2004.
• 31: Vinod Yegneswaran, Paul Barford, and Dave Plonka. On the design and use of Internet sinks for network abuse monitoring. Technical Report 1497, University of Wisconsin, Computer Science Department, 2004.
• 32: Cliff C. Zou, Don Towsley, Weibo Gong, and Songlin Cai. Routing Worm: A Fast, Selective Attack Worm based on IP Address Information. UMass ECE Technical Report TR-03-CSE-06, November 2003.

INDEX TERMS

Primary Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection
          Subjects: Invasive software (e.g., viruses, worms, Trojan horses)

General Terms:
Measurement, Security

Keywords:
blackhole monitoring, blackhole placement, computer worms, globally scoped threats, internet motion sensor, network security