Characteristics of illegitimate Internet traffic

Traffic was collected using a simple distributed sensor system in the Internet. The sensors do not initiate or solicit any network activity. The traffic arriving at the sensors, not destined to the honeypots, is classified as illegitimate and analyzed to understand the characteristics of illegitimate traffic in the Internet. The role of distributed sensors in identifying DoS or scanning events is illustrated and the need for sharing sensor measurement data for quantification of activities on a global scale is highlighted. The limitations due to the small number of sensors are examined.