Analyzing Unsolicited Internet Traffic: Measuring IoT Security Threats via Network Telescopes

• URL: http://arxiv.org/abs/2605.02795v1
• Date: Mon, 04 May 2026 16:35:38 GMT
• Title: Analyzing Unsolicited Internet Traffic: Measuring IoT Security Threats via Network Telescopes
• Abstract summary: This study analyzes a 10-day dataset consisting of approximately 22 million packets collected by the ORION network telescope at Merit Network.<n>Results reveal a highly structured and centralized ecosystem, where the top 1% of source IP addresses generate over 81% of total traffic.<n>These findings offer a practical framework for identifying large-scale threat activity and support cybersecurity research and education.
• Score: 0.0
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Network telescopes serve as a critical passive monitoring tool for capturing unsolicited Internet traffic, providing insights into global scanning and reconnaissance behavior. This study analyzes a 10-day dataset during January 2025 consisting of approximately 22 million packets collected by the ORION network telescope at Merit Network. By employing privacy-preserving metadata analysis and lightweight behavioral heuristics, we identify scanning and backscatter patterns without payload inspection. Our results reveal a highly structured and centralized ecosystem, where the top 1% of source IP addresses generate over 81% of total traffic. A significant finding is the dominance of Port 23 (Telnet) and Port 2323 (Telnet Alt), which highlights the persistent nature of IoT security threats and widespread attempts to exploit weak credentials in legacy IoT devices. Furthermore, synchronized surges in packet volume and Shannon entropy indicate coordinated, multi-vector reconnaissance campaigns. These findings offer a practical framework for identifying large-scale threat activity and support cybersecurity research and education.

Related papers

• Detecting Data Exfiltration through I2P Anonymity Networks: A Two-Phase Machine Learning Approach [0.0]
  The Invisible Internet Project (I2P) provides strong anonymity through garlic routing and distributed network architecture.<n>Current network security measures often fail to detect I2P traffic.<n>This paper proposes a two-stage machine-learning model for I2P traffic analysis using the SafeSurf Darknet 2025 dataset.
  arXiv  Detail & Related papers  (2026-05-19T22:46:22Z)
• Characterizing AI-Assisted Bot Traffic in Darknet Data: Implications for ICS and IIoT Security [0.0]
  The rise of automated scanning tools and AI assisted reconnaissance agents has significantly altered internet background traffic patterns.<n>This paper characterizes the evolution of automated bot traffic by analyzing a longitudinal dataset of 192 million passive darknet packets captured across 2021 and 2025 from the Merit ORION Network Telescope.
  arXiv  Detail & Related papers  (2026-05-14T00:07:20Z)
• ShieldNet: Network-Level Guardrails against Emerging Supply-Chain Injections in Agentic Systems [56.613157564882925]
  Malicious behaviors are embedded in seemingly benign tools, silently hijacking agent execution, leaking sensitive data, or triggering unauthorized actions.<n>Despite their growing impact, there is currently no comprehensive benchmark for evaluating such threats.<n>We propose ShieldNet, a network-level guardrail framework that detects supply-chain poisoning by observing real network interactions.
  arXiv  Detail & Related papers  (2026-04-06T05:15:00Z)
• Neurosymbolic Learning for Advanced Persistent Threat Detection under Extreme Class Imbalance [29.991707658663188]
  This paper proposes a neurosymbolic architecture that integrates an optimized BERT model with logic tensor networks (LTN) for explainable APT detection in wireless IoT networks.<n>Results show that neurosymbolic learning enables high-performance, interpretable, and operationally viable APT detection for IoT network monitoring architectures.
  arXiv  Detail & Related papers  (2026-02-28T04:25:50Z)
• Multi-Agent Collaborative Intrusion Detection for Low-Altitude Economy IoT: An LLM-Enhanced Agentic AI Framework [60.72591149679355]
  The rapid expansion of low-altitude economy Internet of Things (LAE-IoT) networks has created unprecedented security challenges.<n>Traditional intrusion detection systems fail to tackle the unique characteristics of aerial IoT environments.<n>We introduce a large language model (LLM)-enabled agentic AI framework for enhancing intrusion detection in LAE-IoT networks.
  arXiv  Detail & Related papers  (2026-01-25T12:47:25Z)
• Multi-Agent-Driven Cognitive Secure Communications in Satellite-Terrestrial Networks [58.70163955407538]
  Malicious eavesdroppers pose a serious threat to private information via satellite-terrestrial networks (STNs)<n>We propose a cognitive secure communication framework driven by multiple agents that coordinates spectrum scheduling and protection through real-time sensing.<n>We exploit generative adversarial networks to produce adversarial matrices, and employ learning-aided power control to set real and adversarial signal powers for protection layer.
  arXiv  Detail & Related papers  (2026-01-06T10:30:41Z)
• Cyberscurity Threats and Defense Mechanisms in IoT network [6.149504226373647]
  The rapid proliferation of Internet of Things technologies, projected to exceed 30 billion interconnected devices by 2030, has significantly escalated the complexity of cybersecurity challenges.<n>This survey aims to provide a comprehensive analysis of vulnerabilities, threats, and defense mechanisms, focusing on the integration of network and application layers within real-time monitoring and decision-making systems.
  arXiv  Detail & Related papers  (2026-01-02T04:06:03Z)
• Intelligent Detection of Non-Essential IoT Traffic on the Home Gateway [45.70482328441101]
  This work presents ML-IoTrim, a system for detecting and mitigating non-essential IoT traffic by analyzing network behavior at the edge.<n>We test our framework in a consumer smart home setup with IoT devices from five categories, demonstrating that the model can accurately identify and block non-essential traffic.<n>This research advances privacy-aware traffic control in smart homes, paving the way for future developments in IoT device privacy.
  arXiv  Detail & Related papers  (2025-04-22T09:40:05Z)
• TORCHLIGHT: Shedding LIGHT on Real-World Attacks on Cloudless IoT Devices Concealed within the Tor Network [16.6364461552258]
  Research revealed an unexpected pattern of substantial Tor network traffic targeting cloudless IoT devices.<n>We developed TORCHLIGHT, a tool designed to detect both known and unknown threats targeting cloudless IoT devices by analyzing Tor traffic.<n>For the first time, we have demonstrated that attackers are indeed using Tor to conceal their identities while targeting cloudless IoT devices.
  arXiv  Detail & Related papers  (2025-01-28T08:13:02Z)
• Beyond Detection: Leveraging Large Language Models for Cyber Attack Prediction in IoT Networks [4.836070911511429]
  This paper proposes a novel network intrusion prediction framework that combines Large Language Models (LLMs) with Long Short Term Memory (LSTM) networks. Our framework, evaluated on the CICIoT2023 IoT attack dataset, demonstrates a significant improvement in predictive capabilities, achieving an overall accuracy of 98%.
  arXiv  Detail & Related papers  (2024-08-26T06:57:22Z)
• Large-Scale Security Analysis of Real-World Backend Deployments Speaking IoT-Focused Protocols [4.843690497661255]
  We focus on the security of backends speaking IoT protocols, that is, the backbone of the IoT ecosystem. We gather a dataset of over 337,000 provider data to investigate three major security threats: information, weak authentication, and denial of service. We find that 9.44% backends expose information, 30.38% CoAP-speaking backends are vulnerable to denial of service attacks, and 99.84% of backends use insecure transport protocols.
  arXiv  Detail & Related papers  (2024-05-15T19:04:30Z)
• Towards a Near-real-time Protocol Tunneling Detector based on Machine Learning Techniques [0.0]
  We present a protocol tunneling detector prototype which inspects, in near real time, a company's network traffic using machine learning techniques. The detector monitors unencrypted network flows and extracts features to detect possible occurring attacks and anomalies. Results show 97.1% overall accuracy and an F1-score equals to 95.6%.
  arXiv  Detail & Related papers  (2023-09-22T09:08:43Z)
• Automated Identification of Vulnerable Devices in Networks using Traffic Data and Deep Learning [30.536369182792516]
  Device-type identification combined with data from vulnerability databases can pinpoint vulnerable IoT devices in a network. We present and evaluate two deep learning approaches to the reliable IoT device-type identification.
  arXiv  Detail & Related papers  (2021-02-16T14:49:34Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.