The use of packet inter-arrival times for investigating unsolicited internet traffic

Jacob Zimmermann, Andrew Clark, George Mohay, Fabien Pouget, Marc Dacier

Research output: Chapter in Book/Report/Conference proceedingConference contribution

11 Scopus citations


Monitoring the Internet reveals incessant activity, that has been referred to as background radiation. In this paper, we propose an original approach that makes use of packet Inter-Arrival Times, or IATs, to analyse and identify such abnormal or unexpected network activity. Our study exploits a large set of data collected on a distributed network of honeypots during more than six months. Our main contribution in this paper is to demonstrate the usefulness of IAT analysis for network forensic purposes, and we illustrate this with examples in which we analyse particular IAT peak values. In addition, we pinpoint some network anomalies that we have been able to determine through such analysis. © 2005 IEEE.
Original languageEnglish (US)
Title of host publicationProceedings - First International Workshop on Systematic Approaches to Digital Forensic Engineering
Number of pages16
StatePublished - Dec 1 2005
Externally publishedYes

Bibliographical note

Generated from Scopus record by KAUST IRTS on 2022-09-12


Dive into the research topics of 'The use of packet inter-arrival times for investigating unsolicited internet traffic'. Together they form a unique fingerprint.

Cite this