{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,26]],"date-time":"2026-08-26T15:53:25Z","timestamp":1787759605864,"version":"build-2784847793"},"reference-count":32,"publisher":"MDPI AG","issue":"1","license":[{"start":{"date-parts":[[2014,12,31]],"date-time":"2014-12-31T00:00:00Z","timestamp":1419984000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Entropy"],"abstract":"<jats:p>Network security requires real-time monitoring of network traffic in order to detect new and unexpected attacks. Attack detection methods based on deep packet inspection are time consuming and costly, due to their high computational demands. This paper proposes a fast, lightweight method to distinguish different attack types observed in an IP darkspace monitor. The method is based on entropy measures of traffic-flow features and machine learning techniques. The explored data belongs to a portion of the Internet background radiation from a large IP darkspace, i.e., real traffic captures that exclusively contain unsolicited traffic, ongoing attacks, attack preparation activities and attack aftermaths. Results from an in-depth traffic analysis based on packet headers and content are used as a reference to label data and to evaluate the quality of the entropy-based classification. Full IP darkspace traffic captures from a three-week observation period in April, 2012, are used to compare the entropy-based classification with the in-depth traffic analysis. Results show that several traffic types present a high correlation to the respective traffic-flow entropy signals and can even fit polynomial regression models. Therefore, sudden changes in traffic types caused by new attacks or attack preparation activities can be identified based on entropy variations.<\/jats:p>","DOI":"10.3390\/e17010074","type":"journal-article","created":{"date-parts":[[2014,12,31]],"date-time":"2014-12-31T08:49:33Z","timestamp":1420015773000},"page":"74-101","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":11,"title":["Entropy-Based Characterization of Internet Background Radiation"],"prefix":"10.3390","volume":"17","author":[{"given":"F\u00e9lix","family":"Iglesias","sequence":"first","affiliation":[{"name":"Institute of Telecommunications, Vienna University of Technology, Gu\u00dfhausstra\u00dfe 25 \/ E389, 1040 Vienna, Austria"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Tanja","family":"Zseby","sequence":"additional","affiliation":[{"name":"Institute of Telecommunications, Vienna University of Technology, Gu\u00dfhausstra\u00dfe 25 \/ E389, 1040 Vienna, Austria"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2014,12,31]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"392","DOI":"10.1109\/90.944338","article-title":"Difficulties in Simulating the Internet","volume":"9","author":"Floyd","year":"2001","journal-title":"IEEE\/ACM Trans. Netw."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"35","DOI":"10.1109\/MNET.2012.6135854","article-title":"Issues and future directions in traffic classification","volume":"26","author":"Dainotti","year":"2012","journal-title":"IEEE Netw."},{"key":"ref_3","unstructured":"Paxson, V. Available online: http:\/\/www.bro-ids.org."},{"key":"ref_4","unstructured":"Available online: http:\/\/www.ipoque.com\/en\/products\/pace."},{"key":"ref_5","unstructured":"CISCO Available online: http:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/ios\/12_4t\/qos\/configuration\/guide\/qsnbar1.html."},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"217","DOI":"10.1145\/1090191.1080118","article-title":"Mining anomalies using traffic feature distributions","volume":"35","author":"Lakhina","year":"2005","journal-title":"SIGCOMM Comput. Commun. Rev."},{"key":"ref_7","unstructured":"Moon, S.B., Teixeira, R., and Uhlig, S. (2009, January 1\u20133). Beyond Shannon: Characterizing Internet Traffic with Generalized Entropy Metrics. Passive and Active Network Measurement, Seoul, Korea."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Faloutsos, M., and Kuzmanovic, A. (2014, January 10\u201311). Nightlights: Entropy-based Metrics for Classifying Darkspace Traffic Patterns. Passive and Active Measurement, Los Angeles, CA, USA.","DOI":"10.1007\/978-3-319-04918-2"},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Wustrow, E., Karir, M., Bailey, M., Jahanian, F., and Huston, G. (2010, January 1\u201330). Internet Background Radiation revisited, Melbourne, Australia.","DOI":"10.1145\/1879141.1879149"},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"33","DOI":"10.1109\/MSECP.2003.1219056","article-title":"Inside the Slammer Worm","volume":"1","author":"Moore","year":"2003","journal-title":"IEEE Secur. Priv."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"115","DOI":"10.1145\/1132026.1132027","article-title":"Inferring Internet Denial-of-Service Activity","volume":"24","author":"Moore","year":"2006","journal-title":"ACM Trans. Comput. Syst."},{"key":"ref_12","unstructured":"Aben, E. Available online: http:\/\/www.caida.org\/research\/security\/ms08-067\/conficker.xml."},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Taft, N., and Ricciato, F. (2012, January 12\u201314). One-way Traffic Monitoring with Iatmon. Passive and Active Measurement, Vienna, Austria.","DOI":"10.1007\/978-3-642-28537-0"},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Dainotti, A., King, A., Claffy, K., Papale, F., and Pescape, A. (2012, January 14\u201316). Analysis of a \u201c\/0\u201d Stealth Scan from a Botnet, Boston, MA, USA.","DOI":"10.1145\/2398776.2398778"},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Zseby, T., King, A., Brownlee, N., and Claffy, K. (2013, January 18\u201319). The Day After Patch Tuesday: Effects Observable in IP Darkspace Traffic, Hong Kong, China.","DOI":"10.1007\/978-3-642-36516-4_32"},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Dainotti, A., Squarcella, C., Aben, E., Claffy, K.C., Chiesa, M., Russo, M., and Pescap\u00e9, A. (2011, January 2\u20134). Analysis of Country-wide Internet Outages Caused by Censorship, Berlin, Germany.","DOI":"10.1145\/2068816.2068818"},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"49","DOI":"10.1145\/2378956.2378965","article-title":"Workshop Report: Darkspace and Unsolicited Traffic Analysis (DUST)","volume":"42","author":"Zseby","year":"2012","journal-title":"SIGCOMM Comput. Commun. Rev."},{"key":"ref_18","unstructured":"CAIDA Available online: http:\/\/www.caida.org\/data\/passive\/telescope-patch-tuesday_dataset.xml."},{"key":"ref_19","unstructured":"(2014). Corsaro, version 2.1.0; software suite for performing large-scale analysis of trace data, CAIDA."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"1396","DOI":"10.1109\/TNET.2011.2109009","article-title":"A Network Activity Classification Schema and Its Application to Scan Detection","volume":"19","author":"Treurniet","year":"2011","journal-title":"IEEE\/ACM Trans. Netw."},{"key":"ref_21","unstructured":"Kim, M.S., Kong, H.J., Hong, S.C., Chung, S.H., and Hong, J. (2004, January 19\u201323). A flow-based method for abnormal network traffic detection, Seoul, Korea."},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"1034","DOI":"10.1109\/LCOMM.2007.070761","article-title":"Network anomaly detection using nonextensive entropy","volume":"11","author":"Ziviani","year":"2007","journal-title":"IEEE Commun. Lett."},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Gu, Y., McCallum, A., and Towsley, D. (2005, January 19\u201321). Detecting Anomalies in Network Traffic Using Maximum Entropy Estimation, New Orleans, LA, USA.","DOI":"10.1145\/1330107.1330148"},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Pang, R., Yegneswaran, V., Barford, P., Paxson, V., and Peterson, L. (2004, January 25\u201327). Characteristics of Internet Background Radiation, Taormina, Italy.","DOI":"10.1145\/1028788.1028794"},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Ahmed, E., Clark, A., and Mohay, G. (2009, January 24\u201328). Effective Change Detection in Large Repositories of Unsolicited Traffic, Venice, Italy.","DOI":"10.1109\/ICIMP.2009.8"},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Iglesias, F., and Zseby, T. (2014, January 29\u201331). Modelling IP darkspace traffic by means of clustering techniques, San Francisco, CA, USA.","DOI":"10.1109\/CNS.2014.6997483"},{"key":"ref_27","unstructured":"Porras, P., Saidi, H., and Yegneswaran, V. Available online: http:\/\/mtc.sri.com\/Conficker\/P2P\/."},{"key":"ref_28","unstructured":"Bailey, M., Cooke, E., Jahanian, F., Nazario, J., and Watson, D. (2005, January 2\u20134). The Internet Motion Sensor: A Distributed Blackhole Monitoring System, San Diego, CA, USA."},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"407","DOI":"10.1214\/009053604000000067","article-title":"Least angle regression","volume":"32","author":"Efron","year":"2004","journal-title":"Ann. Stat."},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"265","DOI":"10.1016\/0920-5489(94)90017-5","article-title":"Advanced supervised learning in multi-layer perceptrons: From backpropagation to adaptive learning algorithms","volume":"16","author":"Riedmiller","year":"1994","journal-title":"Comput. Stand. Interfaces"},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"2733","DOI":"10.1214\/12-AOS1049","article-title":"Optimal weighted nearest neighbour classifiers","volume":"40","author":"Samworth","year":"2012","journal-title":"Ann. Stat."},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Rasmussen, C.E., and Williams, C.K.I. (2005). Gaussian Processes for Machine Learning, The MIT Press.","DOI":"10.7551\/mitpress\/3206.001.0001"}],"container-title":["Entropy"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1099-4300\/17\/1\/74\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T21:11:59Z","timestamp":1760217119000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1099-4300\/17\/1\/74"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2014,12,31]]},"references-count":32,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2015,1]]}},"alternative-id":["e17010074"],"URL":"https:\/\/doi.org\/10.3390\/e17010074","relation":{},"ISSN":["1099-4300"],"issn-type":[{"value":"1099-4300","type":"electronic"}],"subject":[],"published":{"date-parts":[[2014,12,31]]}}}