Analyzing Unsolicited Internet Traffic: Measuring IoT Security Threats via Network Telescopes
Fuente:
arXiv
Gespeichert in:
| Hauptverfasser: | , , , , , |
|---|---|
| Format: | Preprint |
| Veröffentlicht: |
2026
|
| Schlagworte: | |
| Online-Zugang: | |
| Tags: |
Tag hinzufügen
Keine Tags, Fügen Sie den ersten Tag hinzu!
|
| _version_ | 1866917459203719168 |
|---|---|
| author | Ismail, Shereen Dyer, Taelyn Martinez, Raul Gastman, Garrett Chavez, Yozelyn Akbarfam, Asma Jodeiri |
| author_facet | Ismail, Shereen Dyer, Taelyn Martinez, Raul Gastman, Garrett Chavez, Yozelyn Akbarfam, Asma Jodeiri |
| contents | Network telescopes serve as a critical passive monitoring tool for capturing unsolicited Internet traffic, providing insights into global scanning and reconnaissance behavior. This study analyzes a 10-day dataset during January 2025 consisting of approximately 22 million packets collected by the ORION network telescope at Merit Network. By employing privacy-preserving metadata analysis and lightweight behavioral heuristics, we identify scanning and backscatter patterns without payload inspection. Our results reveal a highly structured and centralized ecosystem, where the top 1% of source IP addresses generate over 81% of total traffic. A significant finding is the dominance of Port 23 (Telnet) and Port 2323 (Telnet Alt), which highlights the persistent nature of IoT security threats and widespread attempts to exploit weak credentials in legacy IoT devices. Furthermore, synchronized surges in packet volume and Shannon entropy indicate coordinated, multi-vector reconnaissance campaigns. These findings offer a practical framework for identifying large-scale threat activity and support cybersecurity research and education. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2605_02795 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | Analyzing Unsolicited Internet Traffic: Measuring IoT Security Threats via Network Telescopes Ismail, Shereen Dyer, Taelyn Martinez, Raul Gastman, Garrett Chavez, Yozelyn Akbarfam, Asma Jodeiri Cryptography and Security Networking and Internet Architecture Network telescopes serve as a critical passive monitoring tool for capturing unsolicited Internet traffic, providing insights into global scanning and reconnaissance behavior. This study analyzes a 10-day dataset during January 2025 consisting of approximately 22 million packets collected by the ORION network telescope at Merit Network. By employing privacy-preserving metadata analysis and lightweight behavioral heuristics, we identify scanning and backscatter patterns without payload inspection. Our results reveal a highly structured and centralized ecosystem, where the top 1% of source IP addresses generate over 81% of total traffic. A significant finding is the dominance of Port 23 (Telnet) and Port 2323 (Telnet Alt), which highlights the persistent nature of IoT security threats and widespread attempts to exploit weak credentials in legacy IoT devices. Furthermore, synchronized surges in packet volume and Shannon entropy indicate coordinated, multi-vector reconnaissance campaigns. These findings offer a practical framework for identifying large-scale threat activity and support cybersecurity research and education. |
| title | Analyzing Unsolicited Internet Traffic: Measuring IoT Security Threats via Network Telescopes |
| topic | Cryptography and Security Networking and Internet Architecture |
| url | https://arxiv.org/abs/2605.02795 |