Skip to Content
[CAIDA - Center for Applied Internet Data Analysis logo]
Center for Applied Internet Data Analysis
www.caida.org > publications : papers : 2013 : day_after_patch_tuesday
The Day After Patch Tuesday: Effects Observable in IP Darkspace Traffic
T. Zseby, A. King, N. Brownlee, and k. claffy, "The Day After Patch Tuesday: Effects Observable in IP Darkspace Traffic", in Passive and Active Network Measurement Workshop (PAM), Mar 2013, vol. 7799, pp. 273--275.
|   View full paper:    DOI    PDF (abstract only)    |  Citation:    BibTeX    Resource Catalog   |

The Day After Patch Tuesday: Effects Observable in IP Darkspace Traffic

Tanja Zseby1, 2
Alistair King1
Nevil Brownlee1, 3
kc claffy1
1

CAIDA, San Diego Supercomputer Center, University of California San Diego

2

Fraunhofer Institute for Open Communication Systems (FOKUS), Berlin

3

University of Auckland, New Zealand

We investigated how Patch Tuesday affects the volume and characteristics of malicious and unwanted traffic as observed by a large IPv4 (/8) darkspace monitor over the first six months of 2012. We did not discover significant changes in overall traffic volume following Patch Tuesday, but we found a significant increase of the number of active hosts sending to our darkspace monitor the day after Patch Tuesday for all six investigated months. Our early results suggest the effects of Patch Tuesday are worth deeper investigation. Detecting time intervals during which new sources become active can help tune sampling methods toward activity periods that likely contain more interesting information (i.e., many new malicious sources) than other time periods.

Keywords: network telescope, security
  Last Modified: Wed Dec-15-2021 16:33:33 UTC
  Page URL: https://www.caida.org/publications/papers/2013/day_after_patch_tuesday/index.xml