IP addresses

Patient s Web site URL, computer IP address, and/or e-mail address... 

Then traceroute sends datagram with TTL=2 that allows determine an IP-address of the next router ... 

It should be noted that the IP-address of attack source, and the coordinates of the attacked port can be detected by the user applying the standard operating system Unix or the Windows utilities, the net stat, the sock list for example or any IDS. 

Fadia A, and P. Ankit, Getting geographical Information using an IP Address, New York Association for Computing Machinery, 2000. 

Figure 10 shows behavior that is consistent with that of a mail server. Note that SMTP and DNS activities occur at similar levels. This is consistent with the mail transmission process in which the host portion of the address must be converted to an IP address before the mail can be sent. 

It is worth noting that, according to these definitions, we consider that we have two distinct Sources of attacks when a given attacking IP address is observed twice on the same Environment with more than 24 hours between the two observations. The reason for this doing is experimental. We have found out that it was extremely rare, not to say impossible, to see Large... 

Session lasting more than a couple of seconds. It is also extremely rare to observe the same IP address in multiple days. Last but not least, we do know that most of the attacks come from personal PCs which, usually, use temporary addresses [15], [16]. For all these reasons, it is quite likely that the same IP address observed in two different days is not linked to a single physical machine. Therefore, it makes sense to separate, in the database, the activities of the first from the activities of the second one by giving them distinct Source identifiers. 

Sourcejd is equivalent to the expected double key IP Address,DateJd). For the Large Session table, the primary key Large Session Jd is equivalent to the expected double key Source Jd,Environment Jd). Finally, similarly to the two last cases, the primary key Tiny Session Id from table Tiny Session is equivalent to the expected key pair Sourcejd, Hostjd). Some redundancies have also been introduced on purpose as an illustration, the... 

What is the percentage of IP addresses observed during more than one day ... 

The answer to the third question tells us if some IP addresses have been observed on multiple platforms the very same day. This is given by the following query ... 

The fourth question goes one step further than the previous one by looking at the percentage of IP addresses that have been observed on two different days. In other words, how many IP addresses are found under more than one Source identifier This number can be found by dividing the result of this query ... 

SELECT count(distinct(IP Address)) FROM Source... 

The result is around 91%. This simply means that it is unlikely to observe the same attacking IP address twice on the same platform. The last two questions highlight the fact that, first, attacks are issued from a very large pool of IP addresses and, second, that it might not be worth the effort of implementing the notion of blacklists [25] since, apparently, a few of them are observed more than once. 

The Backscatter identification is quite straightforward. Indeed, backscatter packets are responses to connections requests issued by spoofed IP addresses, typically in the case of a Denial of Service attack against a third party. If our addresses are used (spoofed) in the course of this attack, we will see the responses of the victim sent to us without us having talked to him first. These attacks have been very well-analyzed by Moore et al. in [43], [44], Figure 9 summarizes the various types of responses (column response from victim ) that can be sent against our honeypots. These packets hit a large variety of ports that are traditionally unused, such as 27374 (TCP RST), 11224 (TCP SYN ACK), 9026 (RST ACK), etc. 

GeoBytes IP Address Locator Tool, home page http //www.geobytes.com/IPLocator. htm... 

Data enrichment is presented at the lower left comer of Figure 1. Data enrichment occurs when heterogeneous contextual information is entered in the event database. The same object can be represented by heterogeneous information depending on the data source. For example, the Windows NT event log can give us a host name, the network intrusion detection system a host IP address, and the wireless access point a MAC address, this for the same machine. The data enrichment functions attempt to complete and reconcile heterogeneous information entered in the database. 

Logs represent host by three different keys, a host name, a host IP address, and a host MAC address. The name is either fully qualified or a simple machine name, depending on the information source. This type of information is often provided by host-based information sources, or by devices configured to do on-the-fly reverse DNS mapping. An IP address is often provided by network-based IDS sensors and other network equipments. Finally, MAC addresses are provided by low-level networking devices such as wireless access points and switches, when specific network or wireless attacks are detected. All three keys are frequently found in event logs. 

The enrichment process (update hosts) attempt among other things to complete the key information associated with a host in the database. If a host is identified by an IP address, then a reverse DNS lookup is attempted to obtain the host name. If a host is identified by a host name, a DNS lookup is also attempted. Both operations are costly and would result in undue delays upon insertion of a new host, hence the choice of off-loading the loader and pushing such task to a background process. 

The dynamic host configuration protocol (DHCP (Droms, 1997)) allows the same machine to have multiple IP addresses over time. Moreover, host name information is sometimes generic as well, reusing for example the two last bytes of the IP address. When this is the case, our application is not able to uniquely identify a machine. 

In the case of VPN-connected laptops (which is also used for wireless connections), the IP address of the laptop resolves to the IP address of the VPN concentrator. Therefore, it is impossible to retrieve the physical location of the infected machine and the connection is terminated. 

A number of issues remain related to the reliability of host information. We are currently investigating the possible use of traceroute to more precisely locate hosts within a geographic area. We are also looking into the capture of DHCP messages or logs, which would provide a temporal view of the evolution of IP addresses. 

KDD database consists of 4940210 records where every record describes one TCP/IP connection. Only 20% of records represent normal connections. A connection is by a sequence of TCP packets during a duration whose starting time and ending time are both well defined, and data flow during this duration from a source IP address to a target IP address under some well defined protocol. Each connection is labeled as either normal or attack. In the latter case, the connection should be with exactly one specific attack type. 

The IP address is generally associated with fully qualified domain name which users recognize and use. The name of a computer can then be < computer >. domain... 

As discussed earlier, the future of journals is clearly electronic. However, there are many reasons why journal articles are problematic in comparison to other documents such as web pages and databases. First, most chemistry journals (with the notable exception of Chemistry Central Journal, www.journal.chemistrycentral. com) are not open access, and thus the content of articles is restricted by the publishers. Although most universities and large organizations have institutional subscriptions to the popular journals, access usually requires validation on computer IP addresses or the use of private login credentials. Thus, automated access to this information by a computer is difficult. Further, it is unclear whether the terms under which journal articles are made available permit automated processing of the content... 

Computer The computer was disconnected from the network and the IT department was informed that the socket (IP address) could be reallocated if required. The hard drive of the Macintosh was reformatted before the computer was removed from site to ensure that no confidential data remained. 

Computers on the Internet are identified through IP addresses. IP addresses of the sending and receiving computers together with some other information are included in a header created for each packet. This is the reason why all packets from one data file find their way to the same computer... 

C. The Domain Name System (DNS) is used to resolve Internet host names or domain names to IP addresses. See Chapter 18 for more information. 

---