Characteristics of Internet Background Radiation Authors Ruoming Pang

Characteristics of Internet Background Radiation Authors: Ruoming Pang, Vinod Yegneswaran, Paul Barford, Vern Paxson, Larry Peterson ACM Internet Measurement Conference (IMC), 2004 Presenter: Tai Do CDA 6938 UCF, Spring 2007

Introduction • Background Radiation: – Traffic sent to unused addresses. – Nonproductive traffic: malicious (flooding backscatter, hostile scan, spam) OR benign (misconfigurations). – Pervasive nature (hence “background”).

Backscatter Source: [MVS 01]

Introduction • Goals of Characterization: – What is all this nonproductive traffic trying to do? – How can we filter it out to detect new types of malicious activity?

Outline • Introduction • Measurement Methodology – Filtering – Responders – Experimental Setup • Data Analysis • Concluding Remarks

Measurement Methodology (Filtering) • Enormous volume of data: – 30, 000 packets/sec of background radiation on a Class A network. • Source-Destination Filtering: – Assumption: background radiation sources posses the same degree of affinity to monitored IP addresses – For each source, keep the connections to N destinations.

Measurement Methodology (Filtering)

Measurement Methodology (Filtering)

Measurement Methodology (Active Responders) • Why Active Responders? – Elicit further activity from scanners. – Differentiate different types of background radiation. • Stateless Responder: based on Active Sink. • Stateful Responder: based on Honeyd.

Measurement Methodology (Application-Level Responders) • Data-driven: – Which responders to build is based on observed traffic volumes. • Application-level Responders: – Not only adhere to the structure of the underlying protocol, but also to know what to say. • New types of activities emerge over time, responders also need to evolve. • What degree can we automate the development process of responders?

Measurement Methodology (Application-Level Responders) • Responders developed for: – HTTP (port 80) – Net. BIOS (port 137/139), – CIFS/SMB (port 139/445) – DCE/RPC [10] (port 135/1025 and CIFS named pipes) – Dameware (port 6129). – Backdoors installed by My. Doom (port 3127) and Beagle (port 2745)

Measurement Methodology (Experimental Setup) • Two different systems: i. Sink, and LBL Sink. • Traces collected from three sites: – Class A network (large) – UW campus (medium) – Lawrence Berkeley Lab (LBL) (small) • Same forms of application response. • Different underlying mechanisms. • Support two kinds of data analysis: – Passive analysis: no filter, no responder – Active analysis: with filter, and responder

Experimental Setup: i. Sink

Experimental Setup: LBL Sink

Outline • Introduction • Measurement Methodology • Data Analysis – Passive Analysis – Active Analysis • Activities in Background Radiation • Characteristics of Sources • Concluding Remarks

Passive Measurement Traffic Composition • What is the type and volume of observed traffic without actively responding to any packet? • Findings: – TCP dominates in all three networks (comparing to ICMP and UDP) – TCP/SYN packets constitute a significant portion of the background radiation traffic. – A small number of ports are the targets of a majority of TCP/SYN packets.

Activities in Background Radiation • Study dominant activities on the popular ports. • Traffic is divided by ports: – Consider all connections between a sourcedestination pair on a given destination port. • Background Radiation concentrates on a small number of ports: – Only look at the most popular ports. – Many popular ports are also used by the normal traffic use application semantic level. • Investigate 12 ports.

TCP Port 80 (HTTP) • Targeted against Microsoft IIS server. • Dominant activity is a Web. DAV bufferoverrun exploit.

TCP Port 80 (HTTP) Port 80 Activities

Characteristics of Sources • Study background radiation activities coming from the same source IP (activity vector). • Activity vector in three dimensions: – Across ports – Across destination networks – Over time • Caveat: – DHCP: hosts might be assigned different addresses over time.

Sources Across port Activities across ports may give a better picture of a source’s goals Agobot Sources: UW 1

Sources Across port • Top two exploits are extensively observed across all 4 networks.

Sources Seen Over Time • Witty did not persist over a month: deliberately damages its host. • Blaster’s grip on hosts is quite tenacious.

Outline • • Introduction Measurement Methodology Data Analysis Concluding Remarks

Strengths of the paper • First attempt to characterize background radiation. • Good Measurement Methodology: – Effective filtering technique. – Detailed set of active responders for popular ports. • Meaningful Data Analysis: – Passive Analysis: activities concentrate on few popular ports. – Active Analysis: Extreme dynamism in many aspects of background radiation.

Limitations of the paper • The filtering could be biased. – The same kind of activity to all destination IP addresses. – Fail to capture multi-vector worms that pick one exploit per IP address. • DHCP problem makes source IP address less accurate as source identity. • To what extent the development of applicationlevel responders can be automated?

Thank you. Questions?

References • [Barford 2004] Paul Barford. Trends in Internet Measurement. PPT from U. of Wisconsin, Fall 2004. • [MVS 01] Moore, Geoffrey M. Voelker, and Stefan Savage. Inferring Internet Denial-of -Service Activity. In Proceedings of the 10 th USENIX Security Symposium, pages 9 --22. USENIX, August 2001.

Some jargons • Named pipe: supports inter-process communication. FIFO. System-persistent. • CIFS: Common Interface File System. • DCE/RPC: Distributed Computing Environment/Remote Procedure Call • SAMR: Security Account Manager Remote service • srvsvc: server service • msmsgri 32. exe: ? ? ? • SMB: • Autorooter: similar to worms, without self-propagation