Incident analysis center NICTER (Network Incident analysis Center for Tactical Emergency Response) is an integration of large-scale networking monitoring and analysis of cyber threats such as botnet or DDoS. Since 2005, NICTER has collaborated with numerous organizations both in Japan and overseas to distribute sensors to monitor darknet in real-time. A darknet is a set of globally announced unused IP addresses. Because there is no computer connected to the darknet, communication (packets) should not actually arrive under the normal usage of the internet. However, in reality, a large amount of packets arrives darknet: scan packets from a computer infected with malware searching for the next infection destination, spoofed packets bouncing back from a server to darknet (called backscatter), or internet-wide scan packets from those research organizations collecting data about internet-connected hosts and their open ports or services running etc. Observing and analysing such network traffic arriving at darknet guide us to the identification of new threats or unknown behavior of botnets which is one of the mission of NICTER's darknet observation.
In Atlas, packets that reach the darknet are animated on the world map based on country, port numbers, and protocol information associated with the source and destination IP addresses.
Cube visualizes packets arriving at NICTER's darknet in a three-dimensional space, based on information about its source and destination IP address.
Stats visualizes time series data of NICTER's darknet traffic (hosts and packets) in a specified period and unit time (5 minutes, 1 hour, 1 day).
Number of unique hosts by country
| country | Hosts | Percentage | ||
|---|---|---|---|---|
 |
China（CN） | 66,263 | 38% | |
 |
United States（US） | 16,513 | 9% | |
 |
India（IN） | 14,221 | 8% | |
 |
Turkey（TR） | 5,383 | 3% | |
 |
Russian Federation（RU） | 4,983 | 3% | |
 |
Brazil（BR） | 3,778 | 2% | |
 |
Republic of Korea（KR） | 3,680 | 2% | |
 |
Iran (Islamic Republic Of)（IR） | 3,603 | 2% | |
 |
Great Britain(United Kingdom)（GB） | 3,102 | 2% | |
 |
Taiwan（TW） | 2,956 | 2% | |
Number of unique hosts by TCP dst port
| Dst Port | Hosts | Percentage | |
|---|---|---|---|
| 23 | 56,469 | 1% | |
| 80 | 23,825 | < 1% | |
| 8080 | 21,458 | < 1% | |
| 2323 | 20,919 | < 1% | |
| 445 | 20,198 | < 1% | |
| 443 | 7,816 | < 1% | |
| 8443 | 7,440 | < 1% | |
| 3389 | 7,281 | < 1% | |
| 22 | 6,704 | < 1% | |
| 5555 | 6,664 | < 1% | |
Number of unique hosts by UDP dst port
| Dst Port | Hosts | Percentage | |
|---|---|---|---|
| 5353 | 4,596 | 1% | |
| 1900 | 3,761 | < 1% | |
| 5060 | 3,727 | < 1% | |
| 1434 | 2,891 | < 1% | |
| 51038 | 2,885 | < 1% | |
| 69 | 2,689 | < 1% | |
| 1027 | 2,515 | < 1% | |
| 56790 | 2,509 | < 1% | |
| 11211 | 2,269 | < 1% | |
| 47808 | 2,175 | < 1% | |
Number of packets by country
| Packets | Percentage | |||
|---|---|---|---|---|
|
United States（US） | 45,963,921 | 35% | |
 |
Azerbaijan（AZ） | 33,560,145 | 25% | |
 |
Bulgaria（BG） | 12,300,211 | 9% | |
 |
Germany（DE） | 6,333,781 | 5% | |
|
China（CN） | 5,732,290 | 4% | |
 |
Lithuania（LT） | 4,303,607 | 3% | |
|
Great Britain(United Kingdom)（GB） | 4,172,344 | 3% | |
 |
Netherlands（NL） | 3,728,517 | 3% | |
 |
Japan（JP） | 2,225,367 | 2% | |
 |
France（FR） | 1,985,170 | 1% | |
Number of packets by TCP dst port
| Dst Port | Packets | Percentage | |
|---|---|---|---|
| 23 | 4,687,881 | 4% | |
| 443 | 2,142,889 | 2% | |
| 80 | 1,802,523 | 1% | |
| 8728 | 1,515,969 | 1% | |
| 3389 | 1,468,477 | 1% | |
| 22 | 1,326,773 | 1% | |
| 8080 | 949,003 | 1% | |
| 5555 | 747,500 | 1% | |
| 2222 | 697,119 | 1% | |
| 1433 | 621,916 | 1% | |
Number of packets by UDP dst port
| Dst Port | Packets | Percentage | |
|---|---|---|---|
| 5060 | 749,671 | 10% | |
| 53 | 617,363 | 8% | |
| 161 | 295,734 | 4% | |
| 1900 | 268,663 | 3% | |
| 123 | 264,556 | 3% | |
| 389 | 229,594 | 3% | |
| 5683 | 177,938 | 2% | |
| 1434 | 125,669 | 2% | |
| 500 | 120,448 | 2% | |
| 5353 | 120,237 | 2% | |
Copyright © National Institute of Information and Communications Technology. All Rights Reserved.
