When connecting to the Internet a new device (e.g. a computer, a server, a consumer IoT device, etc.) that publicly exposes - i.e. uses a public IPv4 address - any service on any given TCP port (e.g. TELNET on port TCP/23, etc.), the new connected node could be remotely contacted by other network nodes that, both legitimately and maliciously, could attempt to remotely connect to the exposed service. To know if a remote connection attempt comes from a legitimate or a malicious node, it is possible to use a honeypot: a network node that acts as the new device, but actually works as a malicious nodes bait. The latter allows making the assumption that all the attempts, incoming to the honeypot, comes from malicious nodes. In this case, how long does it take before a malicious node attempts to remotely connect to the honeypot, for the very first time since it has been connected to the Internet? This article gives an answer to the latter question, describing both network and software environments used to get the appropriate measurements discussed within this document.

How long does it take before a new Internet node is contacted for the very first time?

F M Lauria
2018

Abstract

When connecting to the Internet a new device (e.g. a computer, a server, a consumer IoT device, etc.) that publicly exposes - i.e. uses a public IPv4 address - any service on any given TCP port (e.g. TELNET on port TCP/23, etc.), the new connected node could be remotely contacted by other network nodes that, both legitimately and maliciously, could attempt to remotely connect to the exposed service. To know if a remote connection attempt comes from a legitimate or a malicious node, it is possible to use a honeypot: a network node that acts as the new device, but actually works as a malicious nodes bait. The latter allows making the assumption that all the attempts, incoming to the honeypot, comes from malicious nodes. In this case, how long does it take before a malicious node attempts to remotely connect to the honeypot, for the very first time since it has been connected to the Internet? This article gives an answer to the latter question, describing both network and software environments used to get the appropriate measurements discussed within this document.
2018
Istituto di informatica e telematica - IIT
CyberSecurity
honeypots
Malware
network security
File in questo prodotto:
Non ci sono file associati a questo prodotto.

I documenti in IRIS sono protetti da copyright e tutti i diritti sono riservati, salvo diversa indicazione.

Utilizza questo identificativo per citare o creare un link a questo documento: https://hdl.handle.net/20.500.14243/369558
Citazioni
  • ???jsp.display-item.citation.pmc??? ND
  • Scopus ND
  • ???jsp.display-item.citation.isi??? ND
social impact