A Study of Packet Sampling Methods for Protecting Sensors Deployed on Darknet
Masaki Narita, Keisuke Kamada, Kanayo Ogura, Bhed Bahadur Bista, Toyoo Takata · 2016
A darknet monitoring system is developed to grasp malicious activities on the Internet in an early stage and to copewith them. The darknet monitoring system consists of network sensors deployed widely on the Internet. The sensors capture incoming unsolicited packets. A goal of this system analyzes captured malicious packets and provides effective informationfor protecting good Internet users from malicious activities. To provide effective and reliable information, sensors mustbe deployed in secret and hidden from outside. On the otherhand, attackers intend to detect sensors for evading them. This attempt is known as localization attacks to darknet monitoring systems. If actual location of sensors is revealed to attackers, itis almost impossible to grasp the latest tactics used by attackers. Thus in our previous work, we proposed a packet sampling method, which samples incoming packets based on an attribute of packets sender, to increase a tolerance to a localization attack and to keep a high quality of information publicized by the system. As a result, we almost succeeded to counter from a localization attack, which generates spike on the publicized graph to detect a sensor. However in some cases, proposed sampling method works to attacker's advantage and spikes appear clearly on the graph. Therefore, we propose advancedsampling methods, which sample incoming packets based on multiple attributes of packets sender. In this paper, we presentour improved methods and show a promising evaluation result obtained from the simulation.