TY - CHAP T1 - Re-wiring Activity of Malicious Networks T2 - Passive and Active MeasurementPassive and Active Measurement Y1 - 2012 A1 - Konte,Maria A1 - Feamster, Nick ED - Taft,Nina ED - Ricciato,Fabio KW - Computer science AB - This paper studies the AS-level re-wiring dynamics (changes in the connectivity) of malicious networks. Anecdotal evidence suggests that some malicious ASes that are primarily involved in nefarious activities on the Internet, were sequentially de-peered by providers before their final cut-off (as occurred in the well-publicized cases of Atrivo/Intercage). We present the first systematic study of the re-wiring dynamics of malicious ASes. We tracked the ASes that were listed by Hostexploit over the last two years and compared their AS-level re-wiring dynamics with non-reported ASes. Using a publicly available dataset of Customer-Provider (CP) relations in the Internet’s AS graph, we studied how interconnection between autonomous systems evolves, both for ASes that provide connectivity for attackers and ASes that were not reported as malicious. We find that malicious networks are more aggressive both in forming links with providers and changing their upstream connectivity than other ASes. Our results indicate that the re-wiring dynamics of the networks that host attacks are stable over time, despite the evolving nature of the attacks themselves, which suggests that existing defense mechanisms could benefit from incorporating these features. JA - Passive and Active MeasurementPassive and Active Measurement T3 - Lecture Notes in Computer Science PB - Springer Berlin / Heidelberg VL - 7192 SN - 978-3-642-28536-3 UR - http://www.springerlink.com/content/95vn833728404877/abstract/ ER -