The Internet Motion Sensor - A Distributed Blackhole Monitoring System.

TLDR

The interdependence of national infrastructure and global data networks has made their stability and integrity critical, yet this connectivity exposes network assets to fast‑moving Internet threats such as worms, DDoS attacks, and routing exploits. The study introduces the Internet Motion Sensor (IMS), a globally scoped monitoring system designed to measure, characterize, and track Internet threats. IMS comprises a distributed monitoring infrastructure, a lightweight active responder for traffic differentiation, and a payload‑signature caching mechanism, and was deployed over three years across diverse dark IPv4 address blocks, including nine /8 ranges. Deployments demonstrated IMS’s capability to capture and characterize major Internet threats, including the Blaster worm, Bagle backdoor scans, and SCO denial‑of‑service attacks.

Abstract

As national infrastructure becomes intertwined with emerging global data networks, the stability and integrity of the two have become synonymous. This connection, while necessary, leaves network assets vulnerable to the rapidly moving threats of today’s Internet, including fast moving worms, distributed denial of service attacks, and routing exploits. This paper introduces the Internet Motion Sensor (IMS), a globally scoped Internet monitoring system whose goal is to measure, characterize, and track threats. The IMS architecture is based on three novel components. First, a Distributed Monitoring Infrastructure increases visibility into global threats. Second, a Lightweight Active Responder provides enough interactivity that traffic on the same service can be differentiated independent of application semantics. Third, a Payload Signatures and Caching mechanism avoids recording duplicated payloads, reducing overhead and assisting in identifying new and unique payloads. We explore the architectural tradeoffs of this system in the context of a 3 year deployment across multiple dark address blocks ranging in size from /24s to a /8. These sensors represent a range of organizations and a diverse sample of the routable IPv4 space including nine of all routable /8 address ranges. Data gathered from these deployments is used to demonstrate the ability of the IMS to capture and characterize several important Internet threats: the Blaster worm (August 2003), the Bagle backdoor scanning efforts (March 2004), and the SCO Denial of Service attacks (December 2003).