A cloud-native framework for globally distributed capture and analysis of Internet Background Radiation
Fabricio Bortoluzzi, Barry V. W. Irwin, Carla Merkle Westphall · 2023
Among the existing methods for analysing internet traffic, one focuses on unsolicited and often harmful packets, referred to as Internet Background Radiation (IBR). IBR data can be captured by using cloud-based computing instances to listen for incoming packets and recording the received headers and contents in files using the PCAP format. No services are run on these hosts so all traffic can be regarded as non-legitimate. This work presents the research plan for capturing a year-long sample of the IBR arriving to up to 1500 geographically distributed sensors across a major service cloud provider. In combination with collection, a data analysis pipeline will be constructed to enable the querying of most relevant quantitative and qualitative aspects of the resulting dataset. The ultimate goal is to answer “how is the IBR characterised when captured within the context of cloud computing?”. Results will include packet distribution according to the properties of the network, transport, and application layers, together with an evaluation of traffic linking to botnet activity such as Mirai and Moobot.