The Internet Motion Sensor - A Distributed Blackhole Monitoring System

As national infrastructure becomes intertwined with emerging global data networks, the stability and integrity of the two have become synonymous. This connection, while necessary, leaves network assets vulnerable to the rapidly moving threats of today’s Internet, including fast moving worms, distributed denial of service attacks, and routing exploits. This paper introduces the Internet Motion Sensor (IMS), a globally scoped Internet monitoring system whose goal is to measure, characterize, and track threats. The IMS architecture is based on three novel components. First, a Distributed Monitoring Infrastructure increases visibility into global threats. Second, a Lightweight Active Responder provides enough interactivity that traffic on the same service can be differentiated independent of application semantics. Third, a Payload Signatures and Caching mechanism avoids recording duplicated payloads, reducing overhead and assisting in identifying new and unique payloads. We explore the...

• Type: Conference
• Year: 2005
• Where: NDSS
• Authors: Michael Bailey, Evan Cooke, Farnam Jahanian, Jose Nazario
• Keywords: Computer Networks, Infrastructure Increases Visibility, Internet Motion Sensor, NDSS 2005, Service Attacks