Date: Jul 13 (Tue) - 14 (Wed) 2021, 07:30 - 12:30 PDT
Place: Closed-session Video Teleconference via Zoom

Workshop Overview

The goal of the DUST workshop series is to bring together researchers, operators, and analysts interested in unsolicited traffic analysis, especially traffic destined to unassigned (dark) IP address space.

In this workshop we will discuss the STARDUST project, potential future use and evolution of the STARDUST architecture and tools, as well as research and other infrastructure related to unsolicited Internet traffic.

Participation in DUST is by invitation only.

Topics of Interest

This year’s DUST workshop focuses on three topics:

1. Infrastructure for capture and analysis of unsolicited traffic
2. Research and Education case studies
3. Distributed Telescopes and the future of STARDUST

Program

The workshop seeks to provide a forum for discussion of the science, engineering, and policy challenges associated with darkspace and unsolicited traffic analysis. We expect interested parties to include:

• operators of darkspace monitors
• researchers engaged in darkspace and unsolicited traffic analysis
• scientists interested in working on the UCSD darkspace data
• scientists or organizations interested in setting up a darkspace monitor
• scientists working on related topics (e.g. honeynets, intrusion detection, data sharing, etc.)

The intended outcomes of the workshops include:

• collect feedback about functionality and applications of the STARDUST infrastructure
• establishing policies and mechanisms to enable broader sharing of darkspace data including real-time sharing
• improve scientific methods for darkspace and unsolicited traffic analysis
• combine and compare data from darkspace monitors at different locations
• share experience from darkspace monitor operation (lessons learned) and darkspace data analysis
• establish methods for synchronizing darkspace monitoring efforts

A high-level goal is to facilitate the creation of a community of STARDUST users and darkspace monitor operators and scientists to share data and coordinate future activities.

Agenda

The workshop will begin at 7:30am PDT and adjourn at 12:30pm PDT each day. There will a 30 minute break in between 2 hours of talks. Some invited participants will give talks from papers that are under double-blind submission at IMC and USENIX Security, so they are listed as anonymous. Some participants will be in the TPCs for these conferences, and consent to be removed from the room while these participants are presenting.

Abstracts for some of the talks are provided on a separate page.

July 13 (Tuesday)

• 07:30 PDT: Welcome

  • Agenda & Participants Introductions
    • Alberto Dainotti and KC Claffy (CAIDA / UC San Diego)

• 08:00 PDT: Infrastructure for capture and analysis of unsolicited traffic

  • Presentations
    • Alberto Dainotti (CAIDA / UC San Diego), UCSD Network Telescope and STARDUST
    • Shane Alcock (Alcock Network Intelligence / University of Waikato), Flowtuples IV: Reality Strikes Back
    • Michalis Kallitsis (Merit Network / University of Michigan), ORION: Observatory for Cyber-Risks Insights and Outages of Networks related project

• 10:00 PDT: Break

• 10:30 PDT: Research and Education case studies

  • Presentations
    • Nathan Thai (GreyNoise), GreyNoise Intelligence related website
    • Eric Ziegast (Farsight Security, Inc), Farsight current darknet data collection related website
    • ANONYMOUS, IMC 2021 Paper #4 “Enlightening the Darknets: Augmenting Darknet Visibility with Active Probes”

• 12:30 PDT: End Day 1

July 14 (Wednesday)

• 07:30 PDT: Welcome back, round table discussion

• 08:30 PDT: Distributed Telescopes and the future of STARDUST

  • Presentations
    • Alberto Dainotti (CAIDA / UC San Diego), Session introduction
    • Paul Barford (University of Wisconsin), A Distributed Network Telescope in the FABRIC Infrastructure

• 09:30 PDT: Research and Education case studies, continued

  • Presentations
    • ANONYMOUS, Usenix Security 2022 Paper #145, “Spoki: Unveiling a New Wave of Scanners through a Reactive Network Telescope”

• 10:00 PDT: Break

• 10:30 PDT: Research and Education case studies, continued

  • Presentations
    • Raffaele Sommese/Mattijs Jonker (U Twente), DNS AttackStream
    • ANONYMOUS, IMC 2021 Paper #249 “QUICsand: Quantifying QUIC Reconnaissance Scans and DoS Flooding Events”
    • Michael Collins and Stephen Schwab (USC / ISI), Categorizing and Analyzing Discrete Dark Traffic Classes
    • Rajat Tandon (USC / ISI), Quantifying Cloud Misbehavior related paper
    • Ramakrishna Padmanabhan (CAIDA / UC San Diego), IODA - Internet Outage Detection and Analysis related website

• 12:30 PDT: End Day 2

Fill out Exit Survey

Workshop Organizers

• Alberto Dainotti (CAIDA/UC San Diego)
• kc claffy (CAIDA/UC San Diego)