Dark Space Detection: Inline Enforcement Against Traffic Directed at Non-Existent Network Addresses
Francesco Trama · Zenodo (CERN European Organization for Nuclear Research) · 2026
Dark Space Detection is the automatic identification of, and inline enforcement against, any traffic directed at a network address where no legitimate host exists. If the set of live addresses on a segment is known at any given moment, any packet destined for an address outside that set is a reliable indicator of reconnaissance or lateral movement. No decoy has to be touched and no signature has to match; the destination itself is the tell. This brief describes how PacketViper implements the capability using an existing sensor paired with an inverted context group of active hosts, how it relates to automated moving target defense (AMTD) and deception responders, why it closes the residual coverage gap identified in the PacketViper AI agent containment test, and why operational technology (OT) segments, with small and stable address populations, are the strongest fit for the approach.