Hayden Jananthan,Jeremy Kepner,Michael Jones,William Arcand,David Bestor,William Bergeron,Chansup Byun,Timothy Davis,Vijay Gadepally,Daniel Grant,Michael Houle,Matthew Hubbell,Anna Klein,Lauren Milechin,Guillermo Morales,Andrew Morris,Julie Mullen,Ritesh Patel,Alex Pentland,Sandeep Pisharody,Andrew Prout,Albert Reuther,Antonio Rosa,Siddharth Samsi,Tyler Trigg,Gabriel Wachman,Charles Yee,Peter Michaleas

Abstract:Expanding the scientific tools available to protect computer networks can be aided by a deeper understanding of the underlying statistical distributions of network traffic and their potential geometric interpretations. Analyses of large scale network observations provide a unique window into studying those underlying statistics. Newly developed GraphBLAS hypersparse matrices and D4M associative array technologies enable the efficient anonymized analysis of network traffic on the scale of trillions of events. This work analyzes over 100,000,000,000 anonymized packets from the largest Internet telescope (CAIDA) and over 10,000,000 anonymized sources from the largest commercial honeyfarm (GreyNoise). Neither CAIDA nor GreyNoise actively emit Internet traffic and provide distinct observations of unsolicited Internet traffic (primarily botnets and scanners). Analysis of these observations confirms the previously observed Cauchy-like distributions describing temporal correlations between Internet sources. The Gull lighthouse problem is a well-known geometric characterization of the standard Cauchy distribution and motivates a potential geometric interpretation for Internet observations. This work generalizes the Gull lighthouse problem to accommodate larger classes of coastlines, deriving a closed-form solution for the resulting probability distributions, stating and examining the inverse problem of identifying an appropriate coastline given a continuous probability distribution, identifying a geometric heuristic for solving this problem computationally, and applying that heuristic to examine the temporal geometry of different subsets of network observations. Application of this method to the CAIDA and GreyNoise data reveals a several orders of magnitude difference between known benign and other traffic which can lead to potentially novel ways to protect networks.

What is Normal? A Big Data Observational Science Model of Anonymized Internet Traffic

Mapping of Internet "Coastlines" via Large Scale Anonymized Network Source Correlations

Spatial Temporal Analysis of 40,000,000,000,000 Internet Darkspace Packets

GraphBLAS on the Edge: Anonymized High Performance Streaming of Network Traffic

Focusing and Calibration of Large Scale Network Sensors using GraphBLAS Anonymized Hypersparse Matrices

Anonymized Network Sensing Graph Challenge

Internet Traffic Volumes Are Not Gaussian -- They Are Log-Normal: An 18-Year Longitudinal Study With Implications for Modelling and Prediction (Complete Version)

Using Google Analytics to Support Cybersecurity Forensics

General Graph Data De-Anonymization

Anonymizing Big Data Streams Using In-memory Processing: A Novel Model Based on One-time Clustering

General Graph Data De-Anonymization: From Mobility Traces To Social Networks

Abnormal Traffic Detection: Traffic Feature Extraction and DAE-GAN With Efficient Data Augmentation

Analysis of Abnormal User Behavior on the Internet Based on Time Series Feature Fusion

On the Distribution of Traffic Volumes in the Internet and its Implications

From Bits to Insights: Exploring Network Traffic, Traffic Matrices, and Heavy-Tailed Data

Unsupervised Network Traffic Anomaly Detection Method Based on Attribute Graph in Power Internet of Things

A Human-in-the-Loop Anomaly Detection Architecture for Big Traffic Data of Cellular Network

Data De-anonymization : From Mobility Traces to On-line Social Networks

Anonymization: The imperfect science of using data while preserving privacy

Research on Network Security Filtering Model and Key Algorithms Based on Network Abnormal Traffic Analysis

What's in a Session: Tracking Individual Behavior on the Web