Practical In-Depth Analysis of IDS Alerts for Tracing and Identifying Potential Attackers on Darknet

Jungsuk Song, Younsu Lee, Jang-Won Choi, Joon-Min Gil, Jaekyung Han and Sang-Soo Choi
Additional contact information
Jungsuk Song: Department of Advanced KREONET Security Service, Korea Institute of Science and Technology Information, Daejeon 34141, Korea
Younsu Lee: Department of Advanced KREONET Security Service, Korea Institute of Science and Technology Information, Daejeon 34141, Korea
Jang-Won Choi: Department of Advanced KREONET Security Service, Korea Institute of Science and Technology Information, Daejeon 34141, Korea
Joon-Min Gil: School of Information Technology Eng., Catholic University of Daegu, Gyeongbuk 38430, Korea
Jaekyung Han: Department of Construction Legal Affairs, Kwangwoon University, Seoul 01897, Korea
Sang-Soo Choi: Department of Advanced KREONET Security Service, Korea Institute of Science and Technology Information, Daejeon 34141, Korea

Sustainability, 2017, vol. 9, issue 2, 1-18

Abstract: The darknet (i.e., a set of unused IP addresses) is a very useful solution for observing the global trends of cyber threats and analyzing attack activities on the Internet. Since the darknet is not connected with real systems, in most cases, the incoming packets on the darknet (‘the darknet traffic’) do not contain a payload. This means that we are unable to get real malware from the darknet traffic. This situation makes it difficult for security experts (e.g., academic researchers, engineers, operators, etc.) to identify whether the source hosts of the darknet traffic are infected by real malware or not. In this paper, we present the overall procedure of the in-depth analysis between the darknet traffic and IDS alerts using real data collected at the Science and Technology Cyber Security Center (S&T CSC) in Korea and provide the detailed in-depth analysis results. The ultimate goal of this paper is to provide practical experience, insight and know-how to security experts so that they are able to identify and trace the root cause of the darknet traffic. The experimental results show that correlation analysis between the darknet traffic and IDS alerts is very useful to discover potential attack hosts, especially internal hosts, and to find out what kinds of malware infected them.

Keywords: IDS alerts; darknet traffic; potential attackers; in-depth analysis (search for similar items in EconPapers)
JEL-codes: O13 Q Q0 Q2 Q3 Q5 Q56 (search for similar items in EconPapers)
Date: 2017
References: View complete reference list from CitEc
Citations: View citations in EconPapers (4)

Downloads: (external link)
https://www.mdpi.com/2071-1050/9/2/262/pdf (application/pdf)
https://www.mdpi.com/2071-1050/9/2/262/ (text/html)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:gam:jsusta:v:9:y:2017:i:2:p:262-:d:90124

Access Statistics for this article

Sustainability is currently edited by Ms. Alexandra Wu

More articles in Sustainability from MDPI
Bibliographic data for series maintained by MDPI Indexing Manager ().