To generate this RSDoS Metadata dataset, we processed 5-minute intervals of the raw telescope data extracting the response packets sent by victims of randomly and uniformly spoofed Denial-of-Service attacks ("backscatter" packets). Activity that related to the same victim was summarized in an 'attack vector', following the definitions and methodology described by Moore et al. (2006). We continued to update the attack vectors as long as related activity was still observed.
Once an attack 'completed', we recorded the accumulated statistics. We also geolocated the targeted IP address using NetAcuity Edge Premium Edition data and determined its origin AS using Routeviews Prefix-to-AS mappings ( pfx2as) data.
For each day within the two-year period from March 1, 2015 to February 28, 2017, the RSDoS dataset has a single compressed CSV file of attack vectors. Each attack vector is uniquely identified by the target IP address and the attack start timestamp. Each record contains the following fields:
- The IP address of the attack victim (target_ip)
- The number of distinct attacker IPs in the attack
- The number of distinct attacker ports
- The number of distinct target ports
- The cumulative total number of packets observed in the attack
- The cumulative total number of bytes seen for the attack
- The maximum packet rate (of backscatter packets) seen in the attack, as a moving average per minute
- The timestamp of the first observed packet of the attack
- The timestamp of the last observed packet of the attack
- The autonomous system number of target_ip at the time of the attack
- Country geolocation of target_ip, at the time of the attack
- Continent geolocation of target_ip, at the time of the attack
- The IP protocol value of target-destined packets
- The first observed attacker port
- The first observed target port
- The first-observed ICMP type for the attack vector
- The first-observed ICMP code for the attack vector
- A bit flag indicating if an attack is definitely multi IP protocol
Access to these data is provided through the website of the Information Marketplace for Policy and Analysis of Cyber-risk and Trust (IMPACT). The researcher Memorandum of Agreement (MOA) must be completed before the application to access restricted datasets can be reviewed and approved.
After locating this dataset in the IMPACT data catalog,
- if you don't have an IMPACT account yet, apply for one
- if you have an account, follow the IMPACT instructions for requesting the dataset
Referencing this Dataset
As specified in TOU, if you use this dataset in any publication (including but not limited to: papers, web pages, presentations, and papers published by a third party), you must include the following reference:CAIDA UCSD Randomly and Uniformly Spoofed Denial-of-Service (RSDoS) Metadata dataset - < dates used >, www.impactcybertrust.org, DOI 10.23721/107/1463169Please consider referencing the associated papers if warranted:
Jonker, M., King, A., Krupp, J., Rossow, C., Sperotto, A. and Dainotti, A., 2017. Millions of targets under attack: a macroscopic characterization of the DoS ecosystem. In Proceedings of the ACM 2017 Internet Measurement Conference (pp. 100-113), doi:10.1145/3131365.3131383Moore, D., Shannon, C., Brown, D.J., Voelker, G.M. and Savage, S., 2006. Inferring internet denial-of-service activity. ACM Transactions on Computer Systems (TOCS), 24(2), pp.115-139.Also, please report your publication using this dataset to CAIDA.