The Internet Motion Sensor - A Distributed Blackhole Monitoring System

By Michael Bailey, Evan Cooke, Farnam Jahanian, Jose Nazario. Network and Distributed System Security Symposium, 2005

308 citations recorded by the source corpus.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

The Nepenthes Platform: An Efficient Approach to Collect Malware (2006, methodology): “Slightly more expressive approaches like the Internet Motion Sensor [2] diﬀerentiate services by replying to a TCP SYN paket with TCP SYN-ACK pakets.”
An Inside Look at Botnets (2007, background): “Several recen t studies have demonstrated the utility of unused address space monitors (honeynets) [2 1] that include active response capability as a means for gathering details on networ k attacks [ 9 , 30, 39].”
Understanding the Mirai Botnet (2017, methodology): “We monitored all network requests to a network telescope [9] composed of 4.”
Polymorphic Worm Detection Using Structural Information of Executables (2005, background): “In addition, there are techniques to identify worms by monitoring traffic sent to dark spaces, which are unused IP address ranges [2], or honeypots [4].”
The Zombie Roundup: Understanding, Detecting, and Disrupting Botnets (2005, methodology): “We then demonstrate the size of the botnet problem using evidence from the operator community, the Internet Motion Sensor project [2], and experimental data collected from a honeypot experiment.”
An Algorithm for Anomaly-based Botnet Detection (2006, background): “Honeynets [6] or darknets might be distributed [1] or local and can certainly prove beneficial in terms of providing information about botnet technology.”