TY - GEN
T1 - Collaborative behavior visualization and its detection by observing darknet traffic
AU - Akimoto, Satoru
AU - Hori, Yoshiaki
AU - Sakurai, Kouichi
PY - 2012/12/26
Y1 - 2012/12/26
N2 - Recently, we have a problem about an attack generated by a botnet which consists of a group of compromised computers called bots. An attacker called botmaster controls it and a botnet invokes an attack such as scanning and DDoS attack. In this paper, we use the 3D-visualization to investigate the change of attack according to the darknet traffic. As a result, we discover the attack in which several source IP addresses transmit packets to a single destination within a short period of time. In addition, we find that the packet size and the destination port number are identical on its attack. Furthermore, we propose the method to detect this attack called behavior of collaborative attack. In our proposal, we focus on the number of source IP addresses which transmit packets to the single destination. We detected this packet and the rate of packet with the same packet size and destination port number occupied about 90% of the set unit of extracted packet.
AB - Recently, we have a problem about an attack generated by a botnet which consists of a group of compromised computers called bots. An attacker called botmaster controls it and a botnet invokes an attack such as scanning and DDoS attack. In this paper, we use the 3D-visualization to investigate the change of attack according to the darknet traffic. As a result, we discover the attack in which several source IP addresses transmit packets to a single destination within a short period of time. In addition, we find that the packet size and the destination port number are identical on its attack. Furthermore, we propose the method to detect this attack called behavior of collaborative attack. In our proposal, we focus on the number of source IP addresses which transmit packets to the single destination. We detected this packet and the rate of packet with the same packet size and destination port number occupied about 90% of the set unit of extracted packet.
UR - http://www.scopus.com/inward/record.url?scp=84871392471&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=84871392471&partnerID=8YFLogxK
U2 - 10.1007/978-3-642-35362-8_17
DO - 10.1007/978-3-642-35362-8_17
M3 - Conference contribution
AN - SCOPUS:84871392471
SN - 9783642353611
T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
SP - 212
EP - 226
BT - Cyberspace Safety and Security - 4th International Symposium, CSS 2012, Proceedings
T2 - 4th International Symposium on Cyberspace Safety and Security, CSS 2012
Y2 - 12 December 2012 through 13 December 2012
ER -