Abstract: Embodiments are disclosed for profiling network-level malicious activity. Profiling embodiments include observing malicious activity, representing such activity in accordance with a set of representative features, capturing temporal evolution of this malicious behavior and its dynamics, and using this temporal evolution to reveal key risk related properties of these networks. Embodiments are further disclosed addressing the connectedness of various networks and similarity in network-level maliciousness. Embodiments directed to similarity analyses include focusing on the notion of similarity—a quantitative measure of the extent to which the dynamic evolutions of malicious activities from two networks are alike, and mapping this behavioral similarity to their similarity in certain spatial features, which includes their relative proximity to each other and may be used to help predict the future maliciousness of a particular network.

Abstract: Network security and robustness is analyzed by developing correlations among network maliciousness observations to determine attack susceptibility. Network traffic is analyzed at the autonomous system (AS) level, among connected Internet Protocol (IP) routing prefixes, to identify these observations. The traffic is monitored for any of a number of specified mismanagement metrics. Correlations among these metrics are determined and a unified network mismanagement metric is developed, indicating network susceptibility to potentially malicious attack.

Abstract: Network security and robustness is analyzed by developing correlations among network maliciousness observations to determine attack susceptibility. Network traffic is analyzed at the autonomous system (AS) level, among connected Internet Protocol (IP) routing prefixes, to identify these observations. The traffic is monitored for any of a number of specified mismanagement metrics. Correlations among these metrics are determined and a unified network mismanagement metric is developed, indicating network susceptibility to potentially malicious attack.

Abstract: Embodiments are disclosed for profiling network-level malicious activity. Profiling embodiments include observing malicious activity, representing such activity in accordance with a set of representative features, capturing temporal evolution of this malicious behavior and its dynamics, and using this temporal evolution to reveal key risk related properties of these networks. Embodiments are further disclosed addressing the connectedness of various networks and similarity in network-level maliciousness. Embodiments directed to similarity analyses include focusing on the notion of similarity—a quantitative measure of the extent to which the dynamic evolutions of malicious activities from two networks are alike, and mapping this behavioral similarity to their similarity in certain spatial features, which includes their relative proximity to each other and may be used to help predict the future maliciousness of a particular network.

Abstract: An address resolution system is provided where network devices are arranged to share a common public network address in a public network environment. The address resolution system includes: an address resolution table residing at a router and configured to store a public network address and a source port assigned to each network device registered with the router in connection with a hardware address that uniquely identifies each of the registered network devices; a port management agent residing on a given network device that is configured to receive a request to assign a source port to an application residing on the given network device and transmit the assignment request to the router; and an address resolution service residing at the router that is configured to query the address resolution table in response to the assignment request from the agent and transmit a reply to the agent based on results from the query of the address resolution table.

Abstract: An address resolution system is provided where network devices are arranged to share a common public network address in a public network environment. The address resolution system includes: an address resolution table residing at a router and configured to store a public network address and a source port assigned to each network device registered with the router in connection with a hardware address that uniquely identifies each of the registered network devices; a port management agent residing on a given network device that is configured to receive a request to assign a source port to an application residing on the given network device and transmit the assignment request to the router; and an address resolution service residing at the router that is configured to query the address resolution table in response to the assignment request from the agent and transmit a reply to the agent based on results from the query of the address resolution table.