Exposing Internet Address Use to Enhance Network Security

The use of large numbers of Internet addresses is a common feature of Internet attacks, such as spam and phishing, and the propagation of Internet malware, such as Internet worms and botnets. Current techniques for detecting and stopping malicious Internet behavior, such as intrusion detection systems and spam filters, focus on inspecting the contents of Internet communications, and not on the fact that addresses must be discovered, resolved, and embedded into communications before any malicious activity can succeed. This book investigates two techniques for tracking address use by malicious agents. The first is to predict the addresses an attacker will discover and target by modeling the targeting behavior of different threats and analyzing the structural properties of Internet addressing. The second approach is to monitor address discovery attempts to identify address enumeration. A technique called pervasive darknet monitoring is proposed to detect malicious Internet behavior by identifying address discovery attempts destined for unused and unreachable Internet addresses.