2026-05-11T09:39:35Z https://ipsj.ixsq.nii.ac.jp/oai

oai:ipsj.ixsq.nii.ac.jp:00222837 2025-01-19T13:36:07Z 581:10784:10798

Connection Type Identification and Uplink Speed Estimation of Malware Infected Hosts Connection Type Identification and Uplink Speed Estimation of Malware Infected Hosts Xuping, Huang Shunsuke, Mochizuki Katsunari, Yoshioka Xuping, Huang Shunsuke, Mochizuki Katsunari, Yoshioka [特集:持続可能な社会のIT基盤に向けた情報セキュリティとトラスト] IoT malware, connection type identification, uplink speed estimation IoT malware Mirai and its variants continue to evolve and their activities consume network resources, particularly radio resources. This paper proposes a method to identify connection types and estimate the wireless uplink speed of malware-infected hosts observed by IoT honeypot by using the Connection Type Database of Maxmind's GeoIP2, a well-known industrial resource for IP address related information, and Network Diagnosis Tool (NDT) database, a measurement data set of the uplink speed of various networks. The proposed Mobile Network Identification method divides IP addresses into IP ranges assigned to each Autonomous System (AS), and then employs the NDT database based on the IP ranges. We analyzed the infected hosts observed by IoT honeypot to assess and validate the precision of the proposed technique. Our method estimates the maximum average uplink speed of the infected cellular host to be 40.6Mbps, which is between two reference measurement results of cellar networks, indicating the adequacy of the proposed method. ------------------------------ This is a preprint of an article intended for publication Journal of Information Processing(JIP). This preprint should not be cited. This article should be cited as: Journal of Information Processing Vol.30(2022) (online) DOI　http://dx.doi.org/10.2197/ipsjjip.30.859 ------------------------------ IoT malware Mirai and its variants continue to evolve and their activities consume network resources, particularly radio resources. This paper proposes a method to identify connection types and estimate the wireless uplink speed of malware-infected hosts observed by IoT honeypot by using the Connection Type Database of Maxmind's GeoIP2, a well-known industrial resource for IP address related information, and Network Diagnosis Tool (NDT) database, a measurement data set of the uplink speed of various networks. The proposed Mobile Network Identification method divides IP addresses into IP ranges assigned to each Autonomous System (AS), and then employs the NDT database based on the IP ranges. We analyzed the infected hosts observed by IoT honeypot to assess and validate the precision of the proposed technique. Our method estimates the maximum average uplink speed of the infected cellular host to be 40.6Mbps, which is between two reference measurement results of cellar networks, indicating the adequacy of the proposed method. ------------------------------ This is a preprint of an article intended for publication Journal of Information Processing(JIP). This preprint should not be cited. This article should be cited as: Journal of Information Processing Vol.30(2022) (online) DOI　http://dx.doi.org/10.2197/ipsjjip.30.859 ------------------------------ 情報処理学会 2022-12-15 eng journal article https://ipsj.ixsq.nii.ac.jp/records/222837 1882-7764 AN00116647 情報処理学会論文誌 63 12 https://ipsj.ixsq.nii.ac.jp/record/222837/files/IPSJ-JNL6312013.pdf application/pdf 1.5 MB 2024-12-15