Obtaining And Analyzing On Internet Background Radiation

Internet Background Radiation (IBR) traffic is defined as unsolicited one-way traffic. IBR traffic can be controlled on the basis of understanding the case and its development trade, which can provide protection for the operation of Internet. Obtaining IBR traffic can be divided into obtaining from darknet and obtaining from live network. Darknet is a network which has not been used. China and some other areas whose IP address are relatively scarce do not have the conditions to obtain IBR traffic from darknet. Therefore, the IBR traffic is studied basing on the live network in this thesis, including basing on static data and basing on real-time data.Obtaining IBR traffic from static data pursues high precision and high recall. The FIBR algorithm are selected to obtain IBR traffic from the static data. Firstly, the algorithm is improved, which makes it to output the IBR packets. Then the improved FIBR algorithm is implemented on the IPTAS analysis platform. Afterwards, all IP Trace data which saved in IPTAS are used to get IBR traffic using improved FIBR algorithm. The algorithm ran about 1219 hours. Finally, the IBR traffic which is obtained from the IP Trace in IPTAS in the past decade is analyzed. Some development rules of the IBR traffic are showed and some phenomena are explained in this thesis.The IBR Traffic Real-time Obtaining and Statistical Analysis System is proposed in the research of IBR traffic based on real-time data. This system includes real-time obtaining IBR traffic, IBR traffic preservation, statistical analysis and anomaly detection. Real-time obtaining IBR traffic means that the IBR traffic from the bounder of CERNET in Jiangsu Province can be real-time obtained. IBR traffic preservation means that all of the IBR traffic which is in specified time segment can be saved every day. Measurement analysis means that the IBR traffic which is real-time obtained is analyzed from multiple angles. Anomaly detection means that some correlation detection methods are used to detect unusual events of the byte rate of IBR traffic and scanning port. The design and implementation of the system is given. What's more, the system has been tested.