Loading [a11y]/accessibility-menu.js
Investigating the dark cyberspace: Profiling, threat-based analysis and correlation | IEEE Conference Publication | IEEE Xplore

Investigating the dark cyberspace: Profiling, threat-based analysis and correlation


Abstract:

An effective approach to gather cyber threat intelligence is to collect and analyze traffic destined to unused Internet addresses known as darknets. In this paper, we ela...Show More

Abstract:

An effective approach to gather cyber threat intelligence is to collect and analyze traffic destined to unused Internet addresses known as darknets. In this paper, we elaborate on such capability by profiling darknet data. Such information could generate indicators of cyber threat activity as well as providing in-depth understanding of the nature of its traffic. Particularly, we analyze darknet packets distribution, its used transport, network and application layer protocols and pinpoint its resolved domain names. Furthermore, we identify its IP classes and destination ports as well as geo-locate its source countries. We further investigate darknet-triggered threats. The aim is to explore darknet embedded threats and categorize their severities. Finally, we contribute by exploring the inter-correlation of such threats, by applying association rule mining techniques, to build threat association rules. Specifically, we generate clusters of threats that co-occur targeting a specific victim. Such work proves that specific darknet threats are correlated. Moreover, it provides insights about threat patterns and allows the interpretation of threat scenarios.
Date of Conference: 10-12 October 2012
Date Added to IEEE Xplore: 13 December 2012
ISBN Information:

ISSN Information:

Conference Location: Cork, Ireland

References

References is not available for this document.