Entropy-based characterization of internet background radiation

Abstract

Network security requires real-time monitoring of network traffic in orderto detect new and unexpected attacks. Attack detection methods based on deep packetinspection are time consuming and costly, due to their high computational demands. Thispaper proposes a fast, lightweight method to distinguish different attack types observedin an IP darkspace monitor. The method is based on entropy measures of traffic-flowfeatures and machine learning techniques. The explored data belongs to a portion of theInternet background radiation from a large IP darkspace, i.e., real traffic captures thatexclusively contain unsolicited traffic, ongoing attacks, attack preparation activities andattack aftermaths. Results from an in-depth traffic analysis based on packet headers andcontent are used as a reference to label data and to evaluate the quality of the entropy-basedclassification. Full IP darkspace traffic captures from a three-week observation period inApril, 2012, are used to compare the entropy-based classification with the in-depth trafficanalysis. Results show that several traffic types present a high correlation to the respectivetraffic-flow entropy signals and can even fit polynomial regression models. Therefore,sudden changes in traffic types caused by new attacks or attack preparation activities canbe identified based on entropy variations.