While DRDoS attacks are well-understood in IPv4, it is not known to what extend attackers also make use of services on the IPv6 Internet to perform DRDoS attacks.In this work, we adapted an IPv4-only DRDoS honeypot to observe DRDoS attacks in IPv6.To attract scanners, we publicized our honeypots' addresses on the TUM IPv6 Hitlist.After one year of data collection, however, we observed little to no attackers exploiting IPv6 UDP services for DRDoS attacks.This paper presents our setup, findings, and the lessons learned from trying attract scanners to our DRDoS honeypot: we analyze the interactions we observed over time as well as the source addresses of scanners, and discuss how our choice of the IPv6 Hitlist as an address exposure method possibly impacted our findings.Although we managed to attract several scanners also observed by previous work, our results show that there are currently no attackers performing DRDoS attacks in IPv6, at least among these that rely on the IPv6 Hitlist to discover vulnerable hots.

In this work, we extend Yarrpbox to assess the survivability of the TCP experimental option across paths toward the Tranco Top-100k domains. Our findings highlight middlebox interference and motivate broader Internet-wide studies. This study represents an initial step toward understanding the feasibility of extending TCP in today's Internet, while highlighting potential pitfalls that must be considered by future protocol designers.

Anti-cheat software is a system designed to detect cheats (or hacks) in a video game. This paper investigates operations executed by anti-cheat software and their impact on user privacy. We collected data and analyzed three popular anticheat solutions: BattlEye, FACEIT, and Vanguard. Our analysis reveals that these programs interact with system files, memory, and users’ directories. In addition, the privileged access of these anti-cheat solutions to the operating system and the lack of clarity on what data is collected directly affect user privacy. This conduct risks not complying with current regulations.

Autonomous Systems (ASes) on the Internet use the Border Gateway Protocol (BGP) to distribute routing information. The BGP-a policy-based protocol-defines a best path decision process that chooses one path per prefix. Some researchers assume ASes use the same path for the same prefix, i.e., that ASes are homogeneous networks. However, this is not the case. Previous work has shown the existence of heterogeneous ASes, i.e., ASes that use different best paths for the same prefix. Nevertheless, this work is outdated due to the Internet's fast pace of evolution. Our work thus aims to quantize the number of heterogeneous ASes by improving upon previous limitations. We introduce a novel method to find heterogeneous ASes that works by finding detours in AS paths from different vantage points. Our analysis covers samples from the last 10 years to show the historical growth and ongoing adoption of heterogeneity on the Internet. We found that the number of heterogeneous ASes steadily increased over the last decade. For example, there has been an increase of up to 173% since 2014. Further, especially Content Delivery Networks have become more heterogeneous (an increase of 360%), followed by Internet Service Providers (196%), and Network Service Providers (173%). Lastly, we found that smaller ASes with fewer customers are becoming more prone to being heterogeneous.

Routers are the core building block of the Internet infrastructure. Maintaining a secure router deployment is critical for protecting networks and providing uninterrupted, smooth operation. In this work, we take a first step toward analyzing routers' security on the Internet. We focus on the potential attack surface for routers, i.e., publicly exposed services. Specifically, we investigate what services are commonly running on known router IPv4 addresses. While exposed services may not pose an immediate risk, they do highlight failure to follow best practices, e.g., strict access control lists. We found that more than 40% of known router IPv4 addresses have at least one public-facing service. We also highlight the lack of consistency in applying network-wide security policies.

Intrusion detection in virtualized environments is vital due to the widespread adoption of virtualization technology. A common strategy for achieving this task involves collecting data from the virtual environment and providing it to intrusion detection solutions. However, these solutions can be affected by other elements present in the virtual environment. An approach that has gained prominence is applying machine learning (ML) models to perform anomaly-based intrusion detection based on system call traces. In Linux-based environments, many tools can be used for collecting the system calls issued by processes and containers; two of the most popular are strace and sysdig. This paper introduces a dataset of system call traces collected with sysdig with a focus on anomaly-based intrusion detection for containerized applications and uses this dataset to compare the effectiveness of strace and sysdig data and evaluate the performance of five different ML models for anomaly detection. The results reveal that sysdig is an attractive option, enabling the collection of system call traces with lower overhead than strace while achieving good detection performance with several ML models.

In this study we characterize Distributed Reflection Denial of Service (DRDoS) attack traffic taking into consideration the geographical distribution of victims. This type of characterization is not widely explored in the literature and could help to better understand this type of attack. We aim to explore this gap in the literature using data collected by four honeypots over three and a half years. Our findings highlight attack similarities and differences across continents.

The growth in the use of virtualization in the last ten years has contributed to the improvement of this technology. The practice of implementing and managing this type of isolated environment raises doubts about the security of such systems. Considering the host's proximity to a container, approaches that use anomaly detection systems attempt to monitor and detect unexpected behavior. Our work aims to use system calls to identify threats within a container environment, using machine learning based strategies to distinguish between expected and unexpected behaviors (possible threats).