Identifying and modeling unwanted traffic on the Internet

Abstract

Accurate models of Internet traffic are important for successful testing of devices that provide network security. However, with the growth of the Internet. it has become increasingly difficult to develop and maintain accurate traffic models. While much internet traffic is legitimate, productive communications between users and services, a significant portion of Internet traffic is the result of unwanted messages sent to IP addresses without regard as to whether there is an active host at that address. In an effort to analyze unwanted traffic, tools were developed that generate statistics and plots on captured unwanted traffic to unused IP addresses. These tools were used on a four-day period of traffic received on an inactive IPv4 class A network address space. Each class B subnet in this address space received an average of 7 million packets corresponding to 21 packets per second. Analyses were performed on a range of class B and C subnets with the intent of discovering the types of variability that are characteristic of unwanted traffic. Traffic volume over time, number of scans, destinations ports, and traffic sources varied substantially across class B and C subnets.

(cont.) The results of the analyses, along with tools to replay traffic. allow security tools to be analyzed on the LARIAT network testbed. LARIAT is a real-time adaptable network testbed developed at Lincoln Laboratory that provides an Internet-like environment in which to test network hardware and software.