Abstract

Network traffic is often diurnal, with some networks peaking during the workday and many homes during evening streaming hours. Monitoring systems consider diurnal trends for capacity planning and anomaly detection. In this paper, we reverse this inference and use diurnal network trends and their absence to infer human activity. We draw on existing and new ICMP echo-request scans of more than 5.2M /24 IPv4 networks to identify diurnal trends in IP address responsiveness. Some of these networks are change-sensitive, with diurnal patterns correlating with human activity. We develop algorithms to clean this data, extract underlying trends from diurnal and weekly fluctuation, and detect changes in that activity. Although firewalls hide many networks, and Network Address Translation often hides human trends, we show about 168k to 330k (3.3-6.4% of the 5.2M) /24 IPv4 networks are change-sensitive. These …

Metadata

publication

Proceedings of the 2023 ACM on Internet Measurement Conference, 627-644, 2023

year

2023

publication date

2023/10/24

authors

Xiao Song, Guillermo Baltra, John Heidemann

link

https://dl.acm.org/doi/abs/10.1145/3618257.3624796

resource_link

https://dl.acm.org/doi/pdf/10.1145/3618257.3624796

book

Proceedings of the 2023 ACM on Internet Measurement Conference

pages

627-644