Controlled Data Sharing for Collaborative Predictive Blacklisting

Abstract

Although data sharing across organizations is often advocated as a promising way to enhance cybersecurity, collaborative initiatives are rarely put into practice owing to confidentiality, trust, and liability challenges. We investigate whether collaborative threat mitigation can be realized via controlled data sharing. With such an approach, organizations make informed decisions as to whether or not to share data, and how much. We propose using cryptographic tools for entities to estimate the benefits of collaboration and agree on what to share without having to disclose their datasets (i.e., in a privacy-preserving way). We focus on collaborative predictive blacklisting: Forecasting attack sources based on one’s logs and those contributed by other organizations. We study the impact of different sharing strategies by experimenting on a real-world dataset of two billion suspicious IP addresses collected from Dshield over two months. We find that controlled data sharing yields up to 105 % accuracy improvement on average, while also reducing the false positive rate.

A. Additional Analysis of the DShield Dataset

General Statistics. We present in Fig. 5(a) the histogram of the number of attacks per day, indicating about 30 M daily attacks. We observe a significant increase around day 50 to 100 M attacks. Careful analysis reveals that a series of IP addresses starts to aggressively attack around day 50, indicating a possible DoS attack initiation.

Fig. 5.

General DShield characteristics: (a) histogram of number of attacks per day. (b) Number of unique targets and sources.

Fig. 6.

Fraction of days each target contributes.

Fig. 7.

CDF of entropy of different attack parameters.

Fig. 8.

CDF of inter-arrival time of attacks: (a) per hour, and (b) per second. All indicates the inter-arrival time of any attacks,  / 8 of common  / 8 subnetworks,  / 24 of common  / 24 subnetworks, and IP of the same IP.

Figure 5(b) shows the number of unique targets and sources over time. Detailed analysis shows a stable number of sources and targets. This stability confirms that it should be possible to predict attackers’ tactics based on past observations. An analysis of attacked ports shows that top 10 attacked ports (with more than 10M hits) are Telnet, HTTP, SSH, DNS, FTP, BGP, Active Directory, and Netbios ports. This shows a clear trend towards misuse of popular web services.

In Fig. 6, we plot the CDF of the fraction of victims that contribute logs to DShield over two months, and observe that few victims contribute daily.

Predictability. Figure 7 shows the CDF of the Shannon entropy of the different log entry elements. Since entropy correlates with predictability (following Fano’s inequality [34]), it helps estimate our ability to predict a given IP address, port number or target appearing in the logs. To obtain this figure, we estimate the probability of each victim, source or port being attacked each day. For example, for each port i, we compute:

$$\begin{aligned} \text {Pr}(\text {Port } i \text { on day } j) = \frac{\text {Attacks on Port } i \text { on day }j}{\text { Attacks on day } j} \end{aligned}$$

(1)

We compute the entropy for each day and then aggregate it overall using the CDF. We observe that ports numbers have the lower entropy distribution, indicating a small set of targeted ports: $80\,\%$ of attacks target a set of $2^7=128$ ports, indicating high predictability. We also observe that victims are more predictable than sources, as $90\,\%$ of victims lie within a set of $2^{12}=4096$ victims as compared to $90\,\%$ of sources being in a list of $2^{14}=16,384$ sources. Victims’ set is thus significantly smaller and more predictable than attackers’ set.

Intensity. Figure 8(a) shows the inter-arrival time of attacks in hours, and Fig. 8(b) shows the inter-arrival time of attacks in seconds. We observe that almost all attacks occur within 3-minute windows. IP addresses and  / 24 subnetworks have similar behavior. In particular, Fig. 8(b) shows that in short time intervals, $85\,\%$ of  / 8 subnetworks have short attack inter-arrival time indicating the bursty attacks on such networks. Attackers target subnetworks for a short time and then disappear.