Internet Background Radiation (IBR) is unsolicited traffic captured by network telescopes, primarily composed of scanning activity, denial-of-service backscatter, and misconfigurations. Its analysis provides a valuable source of cyberintelligence for identifying attack trends, emerging vulnerabilities, and malicious payloads. However, existing analysis approaches lack a standardized methodology tailored to IBR’s distinctive characteristics, and conventional flow abstractions such as NetFlow’s 5-tuple are ill-suited for IBR traffic, where over 96% of TCP flows consist of a single packet. This article introduces IBRAM (Internet Background Radiation Analysis Methodology), a structured and modular methodology for IBR traffic analysis comprising three phases: scope definition, iterative processing (normalization, reassembly, aggregation, enrichment, and correlation), and analysis. Central to IBRAM is the concept of IBRflow, a flow abstraction specifically designed for IBR traffic that supports flexible, payload-aware aggregation and hierarchical composition into higher-level structures called IBRevents, enabling the correlation of related scanning activities across protocols. The methodology is validated through a case study using 67 million packets captured over 31 days by a/24 network telescope, demonstrating that iterative IBRflow aggregation can reduce ICMP traffic to a small set of flows representing over 97% of packets while preserving traffic intent. The analysis reproduces findings consistent with prior IBR studies and reveals cross-protocol scanning patterns through IBRevents correlation. Both the analysis tools and the dataset have been made publicly available to the community.

Internet background traffic (or Internet Background Radiation, IBR) consists of unsolicited packets. It is traffic usually generated in the preliminary phases of attacks by computers making enumerations of targets and available services, sent as responses to denial of service attacks, or sent by mistake due to incorrect configurations and commands. Capturing and analysing this traffic enables the observation of Internet activity and serves as an important tool for identifying new types of attacks and attackers. This traffic is captured by “network telescopes”, nodes that advertise blocks of unused IP addresses and store the traffic sent to them. This article studies the traffic received by a network telescope located in Spain during 2023, with more than 4.7 billion packets and 362.39 GB of information. A statistical breakdown of the packets by protocol shows that TCP accounts for 95.96%, UDP for 3.74%, and ICMP for 0.51%. In addition, the behaviour of the traffic generators targeting the telescope’s addresses is examined, and the main attacks – such as NTP and DNS reflection – are analysed. The characteristics of the traffic are compared with those of previous studies, highlighting changes in behaviour and the most common attacks.

From the seminal work of the geneticist Sir Ronald A. Fisher at the beginning of the XX century, it is well-known that co-engineering the design of experiments with the analysis of measurements is a powerful approach in the experimentation and optimization of products and services. While this idea also applies to networks and telematic services, the communication network community has largely ignored key experimental concepts coming from the field of statistics. This paper is intended to introduce and illustrate some of these concepts in real network experiments. We also contribute some tools for statistical inference and interpretation of performance results adjusted for network problems.

Attacks on the Internet are constant, with different typologies and processes. The initial stages usually involve an enumeration of targets and available services, generating what is known as Internet Background Radiation (IBR). Capturing and analysing this traffic has proven to be crucial for the early identification and detection of attacks. Commonly used architectures for the acquisition of background traffic are based on “black holes”, which are systems that collect this traffic by advertising large blocks of unused IP addresses to the Internet, identifying the traffic received as IBR. These systems have a number of inherent drawbacks, such as the requirement to process large volumes of data, and deal with the existence of a large amount of repetitive data, the fact that they are easily identifiable by the IP addresses used and, finally, that they are expensive to maintain. With the aim of improving the above undesired characteristics, this paper proposes “HoDiNT” (HOme DIstributed Network Telescope), a distributed architecture for the acquisition of Internet Background Radiation. HoDiNT is implemented with low-cost advanced acquisition techniques and without the need to use specific IP address ranges, making it easier to hide the sensors. An initial scan of the traffic received for one month is performed on the probes deployed, and a subsequent analysis is performed on the collected data to draw conclusions.

Online advertising is a rapidly growing industry currently dominated by the search engine 'giant' Google. In an attempt to tap into this huge market, Internet Service Providers (ISPs) started deploying deep packet inspection techniques to track and collect user browsing behavior. However, such techniques violate wiretap laws that explicitly prevent intercepting the contents of communication without gaining consent from consumers. In this paper, we show that it is possible for ISPs to extract user browsing patterns without inspecting contents of communication. Our contributions are threefold. First, we develop a methodology and implement a system that is capable of extracting web browsing features from stored non-content based records of online communication, which could be legally shared. When such browsing features are correlated with information collected by independently crawling the Web, it becomes possible to recover the actual web pages accessed by clients. Second, we systematically evaluate our system on the Internet and demonstrate that it can successfully recover user browsing patterns with high accuracy. Finally, our findings call for a comprehensive legislative reform that would not only enable fair competition in the online advertising business, but more importantly, protect the consumer rights in a more effective way.