Questions on “Data Reduction for the Scalable Automated Analysis of Distributed Darknet Traffic” Yao Zhao

Hybrid Architecture IMS + HMS IMS Proxy back to HMS –Detectable by delay

Filtering with First Payload Only use hash of the payload –A little bit change in the first payload will escape –Polymorphic worms

Collaboration Works? The IDS collaboration paper tells that collaboration helps much This paper tries to say collaboration of darknet doesn’t make much sense.

Duration of Event Figure 8 Obtained from one honeypot host Heavy tail? Long durations –A single /17 darknet block need to handle from 40,000 to 200,000 simultaneous connections –But session <> infection session

Different Scale of Darknets