Identifying Internet background radiation traffic based on traffic source distribution

IBR (Internet Background Radiation) traffic identification is significant for malicious behavior detection. This paper presents a novel IBR traffic identification method since traditional methods depend on tough conditions, such as full bi-direction traffic or unassigned IP address space. We firstly explored the traffic source distribution of each destination IP on a traffic dataset, and found that the traffic sources of active IPs are relatively certain but that of inactive IPs are relatively uncertain. Secondly, based on this exploration results, we present a method to identify IBR traffic. It utilizes the presented metric to evaluate the certainty of traffic sources of a destination IP, so as to identify inactive IPs. Then it detects IBR traffic according to some heuristics built according to malicious traffic behavior patterns. We carried out several experiments to evaluate our method on real traffic datasets, and results show that it obtains 99% precision and 0.1% omission rate on detecting IPv4 IBR traffic. The detected IBR traffic includes the traffic that sent to assigned IPs besides unassigned IPs, which is more valuable and practical for detecting the malicious traffic in real networks.