De-anonymizing the internet using unreliable IDs

Yinglian Xie, Fang Yu, Martin Abadi
2009 Proceedings of the ACM SIGCOMM 2009 conference on Data communication - SIGCOMM '09  
Today's Internet is open and anonymous. While it permits free traffic from any host, attackers that generate malicious traffic cannot typically be held accountable. In this paper, we present a system called HostTracker that tracks dynamic bindings between hosts and IP addresses by leveraging application-level data with unreliable IDs. Using a month-long user login trace from a large email provider, we show that HostTracker can attribute most of the activities reliably to the responsible hosts,
more » ... espite the existence of dynamic IP addresses, proxies, and NATs. With this information, we are able to analyze the host population, to conduct forensic analysis, and also to blacklist malicious hosts dynamically.
doi:10.1145/1592568.1592579 dblp:conf/sigcomm/XieYA09 fatcat:w55yuj2enrhdpbm5fyuzkdcmwq