Wednesday, September 20, 2017

The Definition of Unwanted Traffic

The Definition of Unwanted Traffic


This post is written using RFC 4948 as a reference and document where all the details can be found. The goal of this post is to distinguish between two terms used when discussing the security of the ISPs and the Internet today:

  1. Unwanted traffic
  2. Malicious traffic (malicious activity)
The term unwanted traffic is generally used to describe Internet traffic that consumes network and computing resources in ways that do not benefit the owners of the resources. Moreover, traffic on the Internet is made up of packets and so is the unwanted traffic. Unwanted traffic is considered to be a big problem not only because it lowers the efficiency and usefulness of the Internet network, but also because it is a symptom of a vast criminal underground economy called: "Black economy". The underground economy behaves like a parasite inside the Internet network because it uses up resources and feeds through illegal transactions that are concealed, bought and sold within "legal" markets that use the open nature of the Internet. Although unwanted traffic is mostly related to black economy, it also includes denial of service attacks (DoS and DDoS attacks), SPAM, viruses, worms and trojans which are not directly connected to any service offered on those markets. Furthermore, it includes any form of irregular packet or packets with errors that, according to the IP protocol, have to be discarded because they needlessly use up resources.

On the other hand, the term malicious traffic is usually related to the intrusion prevention systems (IPSs) also known as intrusion detection and prevention system (IDPS). Intrusion prevention system is usually an extension of intrusion detection system (IDS) and its specific features can be disabled in order for it to function like one. Malicious traffic, or to IPS known as "malicious activity", originates from malwares. Malware is a software used to disrupt computer operation, gather sensitive information or gain access to private computer systems.

To sum it up, the term of unwanted traffic is actually a wider term than malicious traffic and includes everything that is already included in the term of malicious traffic or malicious activity and more.






download file now