Greynets:
Passive Detection of Unsolicited Network Scans in Small ISP and
Enterprise networks
Introduction
This project involves development of software to allow easy set up and
deployment of a ‘greynet’ for system administrators. Greynets passively
monitor selected unused IP addresses across an entire enterprise or ISP
network ([1], [2]), and should
be effective in quickly detecting network based attackers scanning
across an edge network’s IP address space looking for hosts to infect.
Network-borne host infections are a common precursor to the development
of zombies and botnets, from which much email (and other types of) spam
is launched. Early detection of infection attempts will assist in the
fight against spam.
Acknowledgement
This work is supported by a grant from the auDA Foundation
in December 2007. The auDA Foundation a charitable trust
established by .au Domain Administration Limited (auDA) to promote and
encourage education and research activities that will enhance the
utility of the Internet for the benefit of the Australian community.
News
We are pleased to announce the release of
CAIA Greynets Toolkit 0.5.8.
Background
Network operators are continually challenged by the task of
defending their Internet Protocol (IP) networks from network based
attacks. Viruses and worms regularly probe large swathes of IP space,
looking for vulnerable hosts to infect and then build into the ‘zombie
farms’ and botnets from which much spam originates. We expect that
early
detection of pre-infection network probes will assist in the fight
against email (and similar) spam.
In the past few years network-layer darknets have
increasingly been explored as a means by which network administrators
can monitor for anomalous, externally sourced traffic. However, current
darknet designs require large, contiguous blocks of unused IP addresses
- not always feasible for operators of small ISP or enterprise networks.
We introduce the concept of a greynet - a region of IP
address space that is sparsely populated with darknet IP addresses
interspersed with active (or 'lit') IP addresses. Our project involves
development of software to allow easy set up, and deployment of, a
greynet network monitoring system. Greynets passively monitor selected
unused IP addresses across an entire enterprise or ISP network and have
been previously described and analysed in [1]
and [2]. Greynets are effective in
detecting malware scanning across a network’s IP address space looking
for hosts to infect as a prelude to larger network attacks.
Our software will be implemented under FreeBSD, a stable and freely
available open-source unix-like operating system. Network
administrators will be able to deploy a greynet-based monitoring system
using our software and FreeBSD running on a garden-variety Pentium III
or Pentium 4 class PC. Our tool will monitor individual subnets on its
own, or multiple subnets concurrently when plugged into VLAN trunk
ports on an enterprise or ISP network’s core routers.
As part of this project we will develop and release
tools to assist in
data gathering and analysis, and publish interim
results and papers on
our website. The links above will take you to additional
information.
Project
Leader
Grenville
Armitage
Project Members
Warren Harrop
Lucas Parry
Amiel Heyde
