The UCSD Network Telescope consists of a globally routed, but lightly utilized /8 network prefix, that is, 1/256th of the whole IPv4 address space. It contains few legitimate hosts; inbound traffic to non-existent machines - so called Internet Background Radiation (IBR) - is unsolicited and results from a wide range of events, including misconfiguration (e.g. mistyping an IP address), scanning of address space by attackers or malware looking for vulnerable targets, backscatter from randomly spoofed denial-of-service attacks, and the automated spread of malware. CAIDA continously captures this anomalous traffic discarding the legitimate traffic packets destined to the few reachable IP addresses in this prefix. We archive and aggregate these data, and provide this valuable resource to network security researchers.
From traffic observed at the UCSD network telescope we extract the "backscatter" (response) packets sent by victims of Denial-of-Service attacks to infer properties of these attacks. To generate this DDoS Metadata dataset, we process 5-minute intervals of the raw telescope data creating a summary of all potential DDoS-related events encoded as attack vectors. The description of each attack vector contains the following information:
The thresholds used to determine the attack vectors are defined in the Moore et al., 2006 paper.
- Start time of the 5-min interval
- Number of attack vectors in this interval
- Statistical characteristics of this attack: IP address of the attack victim, cumulative total number of different attacker IPs, the number of different attacker IPs in the attack in this interval, the number of different attacker port numbers used, the number of different target port numbers used, cumulative total number of packets in the attack, total number of packets in the attack in this interval, cumulative total number of bytes in the attack, total number of bytes in the attack in this interval, maximum packets per minute rate seen in the attack, timestamp of the first packet in attack in this interval, timestamp of the last packet in attack in this interval
- Description of the first packet of the attack
If at the end of a given 5-minute interval an attack is still ongoing, then its corresponding attack vector is written to a file containing the state of the attack up to that time. The attack statistics continue to be accumulated in subsequent 5-minute intervals until the attack ends. At that time the attack vector for the whole attack (that is, including the numbers from the beginning of the attack) is recorded.
Each hour of Telescope data produces a single file of observed attack vectors. 24 hourly files for each day are stored in a separate subdirectory. The whole ongoing dataset covering the period from February 2008 till now is stored locally at CAIDA.
Caveats that apply to this dataset
This dataset and the types of worm and denial-of-service attack traffic contained therein are representative only of some spoofed source denial-of-service attacks. Many denial-of-service attackers do not spoof source IP addresses when they attack their victim, in which case backscatter would not appear on a telescope. Attackers can also spoof in a non-random fashion, which will incur an uneven distribution of backscatter across the IPv4 address space, and may cause backscatter traffic to miss any telescope lenses. Note that the telescope does not send any packets in response, which also limits insight into the traffic it sees.
Data Access Policy
These data must be analyized on CAIDA machines, and cannot be downloaded!
Academic researchers, government agencies and corporate entries in the DHS-Approved Locations (Australia, Canada, Israel, Japan, Netherlands, Singapore, United Kingdom) should request access through Information Marketplace for Policy and Analysis of Cyber-risk and Trust (IMPACT) portal. In order for the application to be considered, the researchers must obtain an IMPACT account as well as complete and agree to IMPACT Memorandum of Agreement (MOA).
Academic researchers from other foreign countries can request access through CAIDA by filling out and submitting the online form. It usually takes about five to ten business days to process your request. We carefully review each application and the decision to grant the data access is based on the merits of your proposed data use.
Finally, these data also may be available for government and corporate entities not from DHS-Approved Locations who participate in CAIDA's membership program. Information on membership levels, services, and rates can be found on the CAIDA Sponsorship Information page, or by emailing firstname.lastname@example.org.
Once users are approved for access to this dataset, they will be set up with an account on the CAIDA machine that provides direct access to the Telescope data they requested. Accounts will be valid for a nominal twelve months in which the research is expected to be completed. CAIDA strictly enforces a "take software to the data" policy for this dataset: all analysis must be performed on CAIDA computers; no download of raw data will be allowed. CAIDA provides several basic tools to access the dataset, including CoralReef and Corsaro. Researchers can also upload their own analysis software.
Acceptable Use Agreement
Access to these data is subject to the terms of the following CAIDA Acceptable Use Agreement (printable version in PDF format)
and the supplemental AUA below:
When referencing this data (as required by the AUA), please use:The CAIDA UCSD Network Telescope Aggregrated DDoS Metadata - < dates used >,Also, please, report your publication to CAIDA.
UCSD Network Telescope Datasets
- Historical and Near-Real-Time Network Telescope Dataset
- Aggregated Traffic Data in FlowTuple format
- Daily RSDoS Attack Metadata
- Two Years of Daily RSDoS Attack Metadata (downloadable paper supplement)
- Three Days Of Conficker Dataset
- CAIDA UCSD Network Telescope Traffic Samples
- Witty Worm Dataset
- Code-Red Worms Dataset
- Patch Tuesday Dataset
- Two Days in November 2008 Dataset
- Telescope Educational Dataset
- Telescope Dataset on the Sipscan
- Telescope Darknet Scanners Dataset
For more information about the use of these data in studies of internet censorship, see:
- A. Dainotti, C. Squarecella, E. Aben, K. Claffy, M. Chiesa, M. Russo, and A. Pescape, "Analysis of Country-wide Internet Outages Caused by Censorship",Internet Measur ement Conference (IMC), Berlin, Germany, Nov 2011, pp. 1--18, ACM
- A. Dainotti, R. Amman, E. Aben, and K. Claffy, "Extracting benefit from harm: using malware pollution to analyze the impact of political and geophysical events on the Internet", ACM SIGCOMM Computer Communication Review (CCR), vol. 42, no. 1, pp. 31--39, Jan 2012.
For more information on Conficker and worm attacks, see:
For more information on Backscatter and Denial-of-Service attacks, see:
For more information on the UCSD Network Telescope, see:
For more information on the CoralReef Software Suite, see:
For more information on the Corsaro Software Suite, see:
For a non-exhaustive list of Non-CAIDA publications using Network Telescope data, see: