Background Noise of the Internet: Look from Russian Segment

摘要

Internet background noise (IBN, also known as Internet background radiation) is network packets addressed to nonexistent host (IP-address). Appearing of such packets may point at networks attacks, spreading worms, mass scanning and other abnormality. Studying of IBN can help with early detection of new network threats or with revealing network hostings with loyalty to malicious software. This article describes trap for background noise – “dark collector” (term, constructed in opposite to “honeypot”), and further some important results of its use during four months in end of 2019/ beginning of 2020 years. We detected most active sources of IBN and most attractive protocols for scanning. The trap was placed in Russian segment of Internet. Gathered statistics was compared with results of similar research conducted in Asia-Pacific region (in the area of responsibility APNIC regional Internet registry). This comparison shows that in spite of IBN global spreading some results have regional features. Further suggestions about using the trap are given in the end of this article.