A darknet monitoring system is developed to graspmalicious activities on the Internet in an early stage and to copewith them. The darknet monitoring system consists of networksensors deployed widely on the Internet. The sensors captureincoming unsolicited packets. A goal of this system analyzescaptured malicious packets and provides effective informationfor protecting good Internet users from malicious activities. To provide effective and reliable information, sensors mustbe deployed in secret and hidden from outside. On the otherhand, attackers intend to detect sensors for evading them. Thisattempt is known as localization attacks to darknet monitoringsystems. If actual location of sensors is revealed to attackers, itis almost impossible to grasp the latest tactics used by attackers. Thus in our previous work, we proposed a packet samplingmethod, which samples incoming packets based on an attributeof packets sender, to increase a tolerance to a localization attackand to keep a high quality of information publicized by thesystem. As a result, we almost succeeded to counter from alocalization attack, which generates spike on the publicizedgraph to detect a sensor. However in some cases, proposedsampling method works to attacker's advantage and spikesappear clearly on the graph. Therefore, we propose advancedsampling methods, which sample incoming packets based onmultiple attributes of packets sender. In this paper, we presentour improved methods and show a promising evaluation resultobtained from the simulation.
['Masaki Narita', 'Keisuke Kamada', 'Kanayo Ogura', 'Bhed Bahadur Bista', 'Toyoo Takata']
A Study of Packet Sampling Methods for Protecting Sensors Deployed on Darknet